Cyber Resilience

CVE-2024-10044

CriticalPublic PoC

Published: 30 December 2024

Published
30 December 2024
Modified
29 July 2025
KEV Added
—
Patch
—
CVSS Score v3 9.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
EPSS Score 0.0022 44.8th percentile
Risk Priority 19 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-10044 is a critical-severity SSRF (CWE-918) vulnerability in Lm-Sys Fastchat. Its CVSS base score is 9.3 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 44.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

This vulnerability is AI-related — categorised as APIs and Models; in the Protocol-Specific Risks risk domain; MITRE ATLAS techniques in scope: AI Model Inference API Access (AML.T0040), LLM Prompt Injection (AML.T0051), Manipulate AI Model (AML.T0018).

EU & UK References

Vulnerability details

A Server-Side Request Forgery (SSRF) vulnerability exists in the POST /worker_generate_stream API endpoint of the Controller API Server in lm-sys/fastchat, as of commit e208d5677c6837d590b81cb03847c0b9de100765. This vulnerability allows attackers to exploit the victim controller API server's credentials to perform unauthorized web…

more

actions or access unauthorized web resources by combining it with the POST /register_worker endpoint.

CWE(s)
CWE-918

AI Security AnalysisAI

AI Category
APIs and Models
Risk Domain
Protocol-Specific Risks
OWASP Top 10 for LLMs 2025
None mapped
Classification Reason
lm-sys/fastchat provides Controller API Server endpoints like /worker_generate_stream and /register_worker for serving and managing LLM inference workers, directly fitting APIs for model interaction and deployment.

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1046 Network Service Discovery Discovery
Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, including those that may be vulnerable to remote software exploitation.
attack.mitre.org →
Why these techniques?

The SSRF vulnerability in the public-facing Controller API Server enables exploitation of a public-facing application (T1190) and allows attackers to use server credentials for unauthorized access to internal web resources, facilitating network service discovery (T1046).

MITRE ATLAS TechniquesAI

MITRE ATLAS techniques

AML.T0040: AI Model Inference API AccessAML.T0051: LLM Prompt InjectionAML.T0018: Manipulate AI ModelAML.T0024: Exfiltration via AI Inference APIAML.T0048: External Harms

Affected Assets

lm-sys
fastchat
2024-09-23

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

CA-8 Penetration Testing
addresses: CWE-918

Penetration testing attempts server-side requests to internal resources, identifying SSRF weaknesses for remediation.

SC-7 Boundary Protection
addresses: CWE-918

Outbound connections to external resources can be monitored and limited at the boundary, reducing SSRF impact.

SI-10 Information Input Validation
addresses: CWE-918

Validates server-side URLs and resource references to block SSRF attempts.

SI-4 System Monitoring
addresses: CWE-918

Detects server-side request forgery through monitoring of unexpected outbound connections.

References