| 标题 | Ollama 18.1 and previous Server-Side Request Forgery |
|---|
| 描述 | Server-Side Request Forgery (SSRF) in Ollama's model pull API allows an attacker to read HTTP responses from internal services on the host running Ollama. When a user or application pulls a model from a malicious OCI registry, the registry can respond with a 307 redirect pointing blob downloads to arbitrary internal URLs such as http://127.0.0.1:6379/INFO or http://x.x.x.x/latest/meta-data/. Ollama follows this redirect, fetches the internal resource, and writes the response to a blob file on disk. The attacker can then retrieve the captured data by pushing the model back to an attacker-controlled registry.
The vulnerability exists in server/download.go, which uses the Location header from an attacker-controlled redirect response as the download URL without validating the target against private or reserved IP ranges. Any Ollama deployment where the API is network-accessible is affected, including Docker containers which bind to x.x.x.x and run as root by default. An attacker with network access to the Ollama API can read responses from localhost-bound services such as databases, admin panels, key-value stores, cloud metadata endpoints, and internal APIs. Confirmed on Ollama v0.18.1 (latest stable release) and 0.13.5. The vulnerable code is unchanged on the current main branch.
I have reached out to the vendor about this vulnerability and am awaiting their response. |
|---|
| 用户 | davidrochester (UID 94063) |
|---|
| 提交 | 2026-03-18 05時52分 (7 月前) |
|---|
| 管理 | 2026-04-04 08時29分 (17 days later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 355283 [Ollama 直到 0.18.1 Model Pull API server/download.go 权限提升] |
|---|
| 积分 | 17 |
|---|