Summary
NVIDIA TensorRT-LLM contains a server-side request forgery vulnerability that may allow an attacker to make the server issue requests to unintended destinations.
Under conditions where attacker-controlled request targets or related inputs are accepted, successful exploitation could disclose information or tamper with data accessible from the server environment.
NVIDIA TensorRT-LLM contains a server-side request forgery vulnerability that may allow an attacker to make the server issue requests to unintended destinations.
Under conditions where attacker-controlled request targets or related inputs are accepted, successful exploitation could disclose information or tamper with data accessible from the server environment.
Affected context
The vulnerability affects NVIDIA TensorRT-LLM server deployments where request handling can cause the application to access network resources based on attacker-influenced input. Risk is higher when the server can reach internal services, cloud metadata endpoints, administrative interfaces, or data stores that are not exposed directly to external users.
The vulnerability affects NVIDIA TensorRT-LLM server deployments where request handling can cause the application to access network resources based on attacker-influenced input. Risk is higher when the server can reach internal services, cloud metadata endpoints, administrative interfaces, or data stores that are not exposed directly to external users.
Exploit preconditions
- Attack surface: A network-facing TensorRT-LLM server or API that processes requests capable of influencing outbound resource access
- Required access: The ability to send accepted requests to the affected service; authentication requirements depend on deployment configuration
- Trigger point: Server-side processing of attacker-controlled or insufficiently constrained destination-related input
- Why exploitation is possible: Outbound requests may not be sufficiently restricted by destination, protocol, network location, or response handling
- Attack surface: A network-facing TensorRT-LLM server or API that processes requests capable of influencing outbound resource access
- Required access: The ability to send accepted requests to the affected service; authentication requirements depend on deployment configuration
- Trigger point: Server-side processing of attacker-controlled or insufficiently constrained destination-related input
- Why exploitation is possible: Outbound requests may not be sufficiently restricted by destination, protocol, network location, or response handling
Why this happens
The underlying issue is server-side request forgery, mapped to CWE-918. The vulnerable behavior occurs when a server uses attacker-influenced input to initiate outbound requests without reliably enforcing an allowlist of permitted destinations and protocols. Because those requests originate from the trusted server environment, they may reach internal resources or services that the attacker cannot access directly.
The underlying issue is server-side request forgery, mapped to CWE-918. The vulnerable behavior occurs when a server uses attacker-influenced input to initiate outbound requests without reliably enforcing an allowlist of permitted destinations and protocols. Because those requests originate from the trusted server environment, they may reach internal resources or services that the attacker cannot access directly.
Potential impact
- The attacker may retrieve sensitive information from reachable internal services.
- The vulnerability could expose cloud instance metadata or service credentials.
- An attacker may tamper with data through accessible internal APIs.
- The issue can expand the effective network reach of an external attacker.
- Internal services may be probed or abused through the vulnerable server.
- The attacker may retrieve sensitive information from reachable internal services.
- The vulnerability could expose cloud instance metadata or service credentials.
- An attacker may tamper with data through accessible internal APIs.
- The issue can expand the effective network reach of an external attacker.
- Internal services may be probed or abused through the vulnerable server.
General mitigation guidance
Mitigation generally focuses on reducing server-side network trust and preventing user-controlled input from determining arbitrary destinations.
Common defensive patterns include:
- Allowing outbound requests only to explicitly approved hosts, schemes, and ports.
- Resolving and validating destinations before connection, including protection against redirects, DNS rebinding, and alternate address representations.
- Blocking access to loopback, link-local, private, and other sensitive network ranges unless explicitly required.
- Separating inference services from sensitive management networks and metadata endpoints.
- Applying least-privilege network policies and service identities.
- Avoiding direct use of client-supplied URLs when a fixed server-side mapping can provide the required functionality.
- Limiting response exposure and logging outbound request destinations for investigation.
Mitigation generally focuses on reducing server-side network trust and preventing user-controlled input from determining arbitrary destinations.
Common defensive patterns include:
- Allowing outbound requests only to explicitly approved hosts, schemes, and ports.
- Resolving and validating destinations before connection, including protection against redirects, DNS rebinding, and alternate address representations.
- Blocking access to loopback, link-local, private, and other sensitive network ranges unless explicitly required.
- Separating inference services from sensitive management networks and metadata endpoints.
- Applying least-privilege network policies and service identities.
- Avoiding direct use of client-supplied URLs when a fixed server-side mapping can provide the required functionality.
- Limiting response exposure and logging outbound request destinations for investigation.
How teams detect issues like this
High-level detection approaches include:
- Static analysis for HTTP clients, URL fetchers, proxy utilities, or socket calls that consume request-derived values.
- Code review checks for missing destination allowlists, unrestricted redirects, and inadequate private-address filtering.
- Runtime monitoring of outbound connections from TensorRT-LLM services, especially requests to internal, link-local, or metadata addresses.
- Network policy enforcement that restricts egress to documented service dependencies.
- Alerting on unexpected protocols, ports, destinations, or response patterns.
- Automated security review tools can help identify URL-handling paths, but findings should be validated against deployment-specific network controls.
High-level detection approaches include:
- Static analysis for HTTP clients, URL fetchers, proxy utilities, or socket calls that consume request-derived values.
- Code review checks for missing destination allowlists, unrestricted redirects, and inadequate private-address filtering.
- Runtime monitoring of outbound connections from TensorRT-LLM services, especially requests to internal, link-local, or metadata addresses.
- Network policy enforcement that restricts egress to documented service dependencies.
- Alerting on unexpected protocols, ports, destinations, or response patterns.
- Automated security review tools can help identify URL-handling paths, but findings should be validated against deployment-specific network controls.
Sources
| Source | Link |
|---|---|
| github. | github.com/ |
| nvd. | nvd.nist.gov/ |
| cve. | cve.org/ |
