Incident Overview
On June 24, 2024, Wiz Research disclosed a critical remote code execution vulnerability in Ollama, an open-source platform for running large language models (LLMs). Dubbed Probllama and assigned CVE-2024-37032, this vulnerability allows attackers to execute arbitrary code on affected systems by exploiting a path traversal flaw in the model pulling mechanism. The issue was confirmed by Ollama’s maintainers and patched in version 0.1.34.
The vulnerability stems from insufficient input validation in the /api/pull endpoint, which processes model manifests from private registries. By crafting a malicious manifest with a path traversal payload in the digest field, an attacker can overwrite arbitrary files on the server’s filesystem. This can be escalated to remote code execution, particularly in Docker deployments where the Ollama server runs with root privileges and binds to 0.0.0.0 by default.
Wiz’s research revealed that thousands of Ollama instances remain exposed to the internet without authentication, despite the lack of built-in authentication support in the platform. These exposed servers pose significant risks, including unauthorized access, model theft, and the hijacking of computational resources such as GPUs.
The vulnerability affects both self-hosted and Docker-based deployments of Ollama. In Docker environments, the risk is heightened due to the default configuration exposing the API server to remote exploitation. Non-Docker installations, while less immediately vulnerable, may still be at risk if misconfigured or if additional exploitation techniques are employed.
Possible Root Cause
The root cause of CVE-2024-37032 lies in the improper handling of the digest field in model manifests during the /api/pull process. The digest field, which should contain a cryptographic hash of a model layer, is used directly to construct filesystem paths without validation. This design flaw enables path traversal attacks, allowing attackers to write files to unintended locations on the server.
Specifically, when an attacker supplies a malicious manifest with a digest field containing sequences like ../../../../../../../../../../../../../../../../../traversal, the Ollama server interprets this as a valid path and attempts to store the corresponding file in an arbitrary location. This arbitrary file write capability can be exploited to plant malicious payloads, such as shared libraries, which are then loaded during subsequent API requests.
The vulnerability is exacerbated by Ollama’s default configuration in Docker deployments, where the server binds to 0.0.0.0 and runs with root privileges. This setup allows remote attackers to execute commands with elevated permissions, further amplifying the impact of the path traversal flaw.
The broader context of this vulnerability highlights a recurring issue in AI infrastructure: the rapid adoption of tools and platforms often prioritizes functionality over security. Many AI inference servers, including Ollama, TorchServe, and Ray Anyscale, lack standardized security features such as authentication, making them attractive targets for threat actors. The Probllama vulnerability underscores the need for rigorous input validation and secure default configurations in AI systems.
Takeaways
The Probllama vulnerability serves as a stark reminder of the security risks associated with self-hosted AI infrastructure. Organizations deploying Ollama or similar platforms must prioritize mitigation efforts to reduce exposure to remote code execution and unauthorized access.
- Immediate patching: Upgrade Ollama to version 0.1.34 or later to apply the official fix for CVE-2024-37032. This patch addresses the path traversal flaw and mitigates the risk of remote code execution.
- Disable unauthenticated access: Ollama does not support authentication by default. Organizations exposing Ollama instances to the internet should deploy protective middleware, such as a reverse proxy with authentication, to prevent unauthorized access. This is particularly critical for Docker deployments, where the API server is publicly exposed by default.
- Monitor for exposed instances: Conduct regular scans of internal and external networks to identify exposed Ollama servers. Tools like Wiz Threat Center can help detect vulnerable instances and enforce security policies. Continuous monitoring is essential given the persistent presence of unauthenticated LLM servers online.
- Secure model registries: Private model registries should be treated with the same level of scrutiny as public ones. Validate all inputs, including manifest files, to prevent path traversal and other injection attacks.
- Adopt secure deployment practices: Avoid running AI inference servers with unnecessary privileges. In Docker environments, ensure containers operate with the principle of least privilege and avoid binding services to 0.0.0.0 unless absolutely necessary. Regularly review and update configurations to align with security best practices.
- Plan for AI-specific security controls: The Probllama incident is part of a broader trend of vulnerabilities in AI infrastructure. Organizations should integrate AI security into their overall risk management strategies, including regular vulnerability assessments, penetration testing, and security training for development teams.
The Probllama vulnerability also highlights the importance of responsible disclosure and collaboration between researchers and maintainers. Wiz Research’s timely reporting and the swift response from Ollama’s team demonstrate the value of proactive security research in mitigating risks before they are exploited in the wild. As AI adoption continues to grow, such efforts will be critical in building a more secure foundation for AI systems.
- Educate stakeholders on risks: Many organizations deploy AI tools without fully understanding the associated security implications. Educate developers, operations teams, and leadership on the risks of exposing AI infrastructure to the internet and the importance of secure configurations.
- Remote code execution flaws have been identified in other AI inference servers, including TorchServe and Ray Anyscale. Assume that similar vulnerabilities may exist in other AI tools and proactively implement defenses such as network segmentation, intrusion detection, and regular patch management.