Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Ollama Remote Code Execution Vulnerability #10132

Closed
whereveryouare666 opened this issue Jun 25, 2024 · 4 comments · Fixed by #10218
Closed

Ollama Remote Code Execution Vulnerability #10132

whereveryouare666 opened this issue Jun 25, 2024 · 4 comments · Fixed by #10218
Assignees
@DhiyaneshGeek
Labels
Done Ready to merge new-template request for new template to be created

Comments

@whereveryouare666
Copy link

Template for?

CVE-2024-37032

Details:

PoC
https://www.wiz.io/blog/probllama-ollama-vulnerability-cve-2024-37032
@whereveryouare666 whereveryouare666 added the new-template request for new template to be created label Jun 25, 2024
@Bi0x
Copy link

Bi0x commented Jun 26, 2024 •
edited
Loading

may need rogue registry server, hard for nuclei interactsh. make a poc here https://github.com/Bi0x/CVE-2024-37032
@karkis3c
Copy link

Hello everyone,

I created a working template here

Regards
@affix
Copy link
Contributor

affix commented Jul 3, 2024

It's easy to do this passively if you can hit the /api/version endpoint

The result of hitting the endpoint is

{
"version": "0.1.48"
}

If you extract and check that it's greater than 0.1.33 that should do it without actually performing code execution
@DhiyaneshGeek DhiyaneshGeek added the Done Ready to merge label Jul 8, 2024
@DhiyaneshGeek
Copy link
Member

Hi @karkis3c i have raised a PR for the template that you shared #10218

Thank you once again
@ritikchaddha ritikchaddha linked a pull request Jul 8, 2024 that will close this issue
Create CVE-2024-37032.yaml #10218
Merged
2 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Done Ready to merge new-template request for new template to be created
5 participants
@affix @Bi0x @DhiyaneshGeek @whereveryouare666 @karkis3c