CVE-2024-11045
Cross-Site WebSocket Hijacking (CSWSH) in automatic1111/stable-diffusion-webui
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Cross-Site WebSocket Hijacking (CSWSH) in automatic1111/stable-diffusion-webui
A Cross-Site WebSocket Hijacking (CSWSH) vulnerability in automatic1111/stable-diffusion-webui version 1.10.0 allows an attacker to clone a malicious server extension from a GitHub repository. The vulnerability arises from the lack of proper validation on WebSocket connections at ws://127.0.0.1:7860/queue/join, enabling unauthorized actions on the server. This can lead to unauthorized cloning of server extensions, execution of malicious scripts, data exfiltration, and potential denial of service (DoS).
Reserved 2024-11-09 | Published 2025-03-20 | Updated 2025-03-20 | Assigner @huntr_aiCWE-284 Improper Access Control
huntr.com/bounties/b7ed0d87-0be5-4526-9b21-ffe0d39c283e
Support options
