CVE-2024-11045: Cross-Site WebSocket Hijacking (CSWSH) in automatic1111/stable-diffusion-webui
A Cross-Site WebSocket Hijacking (CSWSH) vulnerability in automatic1111/stable-diffusion-webui version 1.10.0 allows an attacker to clone a malicious server extension from a GitHub repository. The vulnerability arises from the lack of proper validation on WebSocket connections at ws://127.0.0.1:7860/queue/join, enabling unauthorized actions on the server. This can lead to unauthorized cloning of server extensions, execution of malicious scripts, data exfiltration, and potential denial of service (DoS).
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-11045?
CVE-2024-11045 is classified as a moderate severity vulnerability due to its potential for exploitation via WebSocket connections.
How do I fix CVE-2024-11045?
To fix CVE-2024-11045, ensure that WebSocket connections are properly validated to prevent unauthorized access.
What software is affected by CVE-2024-11045?
CVE-2024-11045 affects automatic1111/stable-diffusion-webui version 1.10.0.
Can CVE-2024-11045 allow remote code execution?
CVE-2024-11045 does not directly enable remote code execution, but it may facilitate malicious server extensions.
What steps can I take to mitigate CVE-2024-11045?
Mitigation for CVE-2024-11045 includes implementing strict input validation and monitoring WebSocket connections for suspicious activity.