Summary
LocalAI contains a server-side request forgery vulnerability in its gallery configuration handling. When a submitted gallery configuration URL redirects to an internal service or cloud metadata endpoint, the server may retrieve and return the internal response as gallery content.
Exploitation generally requires access to the model-application endpoint, and could expose internal data or cloud credentials depending on network placement and deployment permissions.
LocalAI contains a server-side request forgery vulnerability in its gallery configuration handling. When a submitted gallery configuration URL redirects to an internal service or cloud metadata endpoint, the server may retrieve and return the internal response as gallery content.
Exploitation generally requires access to the model-application endpoint, and could expose internal data or cloud credentials depending on network placement and deployment permissions.
Affected context
The issue occurs in LocalAI gallery processing when the server accepts a remote configuration URL through the model application workflow. The initial URL is validated, but redirected destinations are not consistently checked before the server follows them. Risk depends on whether the LocalAI process can reach internal services, loopback interfaces, or cloud metadata endpoints.
The issue occurs in LocalAI gallery processing when the server accepts a remote configuration URL through the model application workflow. The initial URL is validated, but redirected destinations are not consistently checked before the server follows them. Risk depends on whether the LocalAI process can reach internal services, loopback interfaces, or cloud metadata endpoints.
Exploit preconditions
- Attack surface: The gallery configuration URL accepted by
POST /models/apply - Required access: Ability to submit a model application request; authentication requirements depend on deployment configuration
- Trigger point: Server-side retrieval of the submitted gallery configuration
- Why exploitation is possible: Validation is applied to the initial URL but may not be enforced across redirects, allowing requests to reach otherwise inaccessible internal destinations
- Attack surface: The gallery configuration URL accepted by
POST /models/apply - Required access: Ability to submit a model application request; authentication requirements depend on deployment configuration
- Trigger point: Server-side retrieval of the submitted gallery configuration
- Why exploitation is possible: Validation is applied to the initial URL but may not be enforced across redirects, allowing requests to reach otherwise inaccessible internal destinations
Why this happens
The vulnerability results from incomplete validation of outbound URLs in a server-side HTTP request workflow. The application checks the user-controlled starting URL but does not adequately validate the final destination after redirection.
This maps to CWE-918: Server-Side Request Forgery, where an application makes network requests on behalf of an attacker without sufficiently restricting destination addresses, protocols, or redirect paths.
The vulnerability results from incomplete validation of outbound URLs in a server-side HTTP request workflow. The application checks the user-controlled starting URL but does not adequately validate the final destination after redirection.
This maps to CWE-918: Server-Side Request Forgery, where an application makes network requests on behalf of an attacker without sufficiently restricting destination addresses, protocols, or redirect paths.
Potential impact
- Internal service responses could be disclosed to an attacker
- Cloud instance metadata or temporary credentials could be exposed
- Internal network topology and service information could be revealed
- Sensitive configuration or administrative endpoints could be accessed
- The LocalAI host could be used as a proxy into protected network segments
- Internal service responses could be disclosed to an attacker
- Cloud instance metadata or temporary credentials could be exposed
- Internal network topology and service information could be revealed
- Sensitive configuration or administrative endpoints could be accessed
- The LocalAI host could be used as a proxy into protected network segments
General mitigation guidance
Mitigation typically focuses on treating all user-controlled URLs as untrusted and enforcing destination controls throughout the complete request lifecycle.
Common defensive patterns include:
- Validate the resolved destination after every redirect
- Permit only explicitly required schemes, hosts, and ports
- Resolve hostnames and block loopback, link-local, private, reserved, and metadata address ranges
- Prefer allowlists of trusted gallery or content providers over general outbound access
- Disable or tightly restrict redirects for server-side fetches
- Apply egress network policies and proxy controls independently of application checks
- Run the service with minimal network reachability and least-privilege credentials
- Avoid returning fetched internal responses directly to clients
Mitigation typically focuses on treating all user-controlled URLs as untrusted and enforcing destination controls throughout the complete request lifecycle.
Common defensive patterns include:
- Validate the resolved destination after every redirect
- Permit only explicitly required schemes, hosts, and ports
- Resolve hostnames and block loopback, link-local, private, reserved, and metadata address ranges
- Prefer allowlists of trusted gallery or content providers over general outbound access
- Disable or tightly restrict redirects for server-side fetches
- Apply egress network policies and proxy controls independently of application checks
- Run the service with minimal network reachability and least-privilege credentials
- Avoid returning fetched internal responses directly to clients
How teams detect issues like this
Organizations can look for SSRF risks through:
- Static analysis of HTTP clients that consume user-controlled URLs
- Code review checks for redirect handling, DNS resolution, and private-address filtering
- Tests covering loopback, private, link-local, metadata, alternate-resolution, and redirect destinations
- Monitoring outbound requests from LocalAI processes to unexpected internal hosts or cloud metadata services
- Network policies that alert on prohibited egress destinations
- Automated security review tools configured to identify missing SSRF protections
Organizations can look for SSRF risks through:
- Static analysis of HTTP clients that consume user-controlled URLs
- Code review checks for redirect handling, DNS resolution, and private-address filtering
- Tests covering loopback, private, link-local, metadata, alternate-resolution, and redirect destinations
- Monitoring outbound requests from LocalAI processes to unexpected internal hosts or cloud metadata services
- Network policies that alert on prohibited egress destinations
- Automated security review tools configured to identify missing SSRF protections
