New 'LLMjacking' Attack Exploits Stolen Cloud Credentials
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-3129 | Unauthenticated RCE in Laravel Ignition error-page package (facade/ignition) Laravel Ignition, the default error-page package bundled with Laravel applications, uses file_get_contents() and file_put_contents() insecurely in its solution-execution feature, allowing unauthenticated remote attackers to read and write arbitrary files on the server. The flaw is triggered by sending a crafted, unauthenticated HTTP request to Ignition's execute-solution endpoint, which is reachable whenever the application runs with debug mode enabled. Attackers can chain the arbitrary file write to execute arbitrary code in the context of the web application, leading to server compromise and, per CISA, ransomware deployment. Any internet-facing Laravel application running a vulnerable version of the Ignition package with debug mode enabled is affected. The vulnerability is known to be exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2023-09-18 with ransomware use confirmed, and EPSS assigns it a 99.9% probability of exploitation within 30 days (100th percentile). Do: Upgrade facade/ignition to 2.5.2 or later on all Laravel applications, or update to a current Laravel release that bundles the fixed package. Ensure production environments run with debug mode disabled and block or restrict the /_ignition/execute-solution endpoint from untrusted access as an interim mitigation. Given confirmed ransomware use, hunt for signs of compromise such as modified environment files, unexpected scheduled tasks, or webshells, and apply the CISA-required mitigations or discontinue use of the product if patching is not possible. | 9.8 | 100% | KEV ransomware PoC ×3 |
| largetens of thousands of internet-facing Laravel apps with debug mode enabled, out of an installed base of hundreds of thousands of Laravel sites |
Full article385 words · extracted from infosecurity-magazine.com · click to collapse
A recent study conducted by the Sysdig Threat Research Team (TRT) has shed light on a novel cyber attack dubbed "LLMjacking," which exploits stolen cloud credentials to target cloud-hosted large language model (LLM) services.
The attackers gained access to these credentials from a vulnerable version of Laravel (CVE-2021-3129), according to a blog post published on May 6.
Unlike previous discussions surrounding LLM-based Artificial Intelligence (AI) systems, which focused on prompt abuse and altering training data, this attack aimed to sell LLM access to other cyber-criminals while the legitimate cloud account owner incurred the costs.
"Attackers are finding more ways to exploit AI models than we initially expected. This finding is proof, yet again, that attackers are innovative — it's evidence that they don't just want the data you're feeding into LLMs, they also want access to your LLMs," Crystal Morin, cybersecurity strategist at Sysdig, told Infosecurity.
In this instance, the attackers exfiltrated cloud credentials to gain access to the cloud environment, where they targeted local LLM models hosted by cloud providers. For instance, they targeted a local Claude (v2/v3) LLM model from Anthropic, which, if left undetected, could result in over $46,000 of LLM consumption costs per day for the victim.
"LLM use is costly. Attackers may consume LLM resources — asking questions and receiving answers — on your dime for all kinds of reasons. They could be asking questions in an attempt to pull your sensitive data out, to develop malicious code or to find vulnerabilities. The options, at this point, are endless," Morin added.
The researchers also uncovered evidence of a reverse proxy being used to access compromised accounts. Moreover, the attackers demonstrated interest in accessing LLM models across different services, utilizing tools to check credentials for ten different AI services, including AWS Bedrock, Azure and GCP Vertex AI, among others.
"Attackers know that LLMs and their data are of interest to others," Morin concluded. "If they can just sell access to it, why would they bother sorting through all the data themselves?"
To mitigate such attacks, Sysdig recommended implementing vulnerability and secrets management practices, along with Cloud Security Posture Management (CSPM) or Cloud Infrastructure Entitlement Management (CIEM) solutions, to minimize permissions and prevent unauthorized access.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/llmjacking-exploits-stolen-cloud/