GHSA-vfp2-c8pq-v6h6: vLLM 0.9.2 before 0.24.0 SSRF via X-Request-Id in P2pNcclConnector
vLLM from 0.9.2 before 0.24.0 contains a server-side request forgery vulnerability that allows API callers to force outbound connections by embedding a decode address in the X-Request-Id header. Attackers can make a P2pNcclConnector prefill worker ZMQ-connect to an attacker host, leaking the NCCL uniqueid and KV-cache tensors or blocking the worker.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/vllmto a version that resolves this vulnerability.Fixed in 0.24.0
Event History
Frequently Asked Questions
Which deployments should be treated as affected?
Deployments using pip vLLM versions 0.9.2 through versions earlier than 0.24.0 should be treated as affected. Exposure requires an API caller that can submit a request with an X-Request-Id header.
What does an attacker need to exploit this issue?
An attacker needs access to the vLLM API and the ability to provide a crafted X-Request-Id header containing a decode address. No authentication or user interaction is indicated by the supplied severity vector.
What could exploitation expose or disrupt?
A crafted request can cause a P2pNcclConnector prefill worker to make a ZMQ connection to an attacker-controlled host. This can leak the NCCL unique_id and KV-cache tensors, or block the worker.
What version should be used to remediate the issue?
Upgrade vLLM to version 0.24.0 or later. The affected range is specified as versions from 0.9.2 before 0.24.0.