Researchers Uncover 'LLMjacking' Scheme Targeting Cloud
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-3129 | Unauthenticated RCE in Laravel Ignition error-page package (facade/ignition) Laravel Ignition, the default error-page package bundled with Laravel applications, uses file_get_contents() and file_put_contents() insecurely in its solution-execution feature, allowing unauthenticated remote attackers to read and write arbitrary files on the server. The flaw is triggered by sending a crafted, unauthenticated HTTP request to Ignition's execute-solution endpoint, which is reachable whenever the application runs with debug mode enabled. Attackers can chain the arbitrary file write to execute arbitrary code in the context of the web application, leading to server compromise and, per CISA, ransomware deployment. Any internet-facing Laravel application running a vulnerable version of the Ignition package with debug mode enabled is affected. The vulnerability is known to be exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2023-09-18 with ransomware use confirmed, and EPSS assigns it a 99.9% probability of exploitation within 30 days (100th percentile). Do: Upgrade facade/ignition to 2.5.2 or later on all Laravel applications, or update to a current Laravel release that bundles the fixed package. Ensure production environments run with debug mode disabled and block or restrict the /_ignition/execute-solution endpoint from untrusted access as an interim mitigation. Given confirmed ransomware use, hunt for signs of compromise such as modified environment files, unexpected scheduled tasks, or webshells, and apply the CISA-required mitigations or discontinue use of the product if patching is not possible. | 9.8 | 100% | KEV ransomware PoC ×3 |
| largetens of thousands of internet-facing Laravel apps with debug mode enabled, out of an installed base of hundreds of thousands of Laravel sites |
Full article455 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananMay 10, 2024Vulnerability / Cloud Security
Cybersecurity researchers have discovered a novel attack that employs stolen cloud credentials to target cloud-hosted large language model (LLM) services with the goal of selling access to other threat actors.
The attack technique has been codenamed LLMjacking by the Sysdig Threat Research Team.
"Once initial access was obtained, they exfiltrated cloud credentials and gained access to the cloud environment, where they attempted to access local LLM models hosted by cloud providers," security researcher Alessandro Brucato said. "In this instance, a local Claude (v2/v3) LLM model from Anthropic was targeted."
The intrusion pathway used to pull off the scheme entails breaching a system running a vulnerable version of the Laravel Framework (e.g., CVE-2021-3129), followed by getting hold of Amazon Web Services (AWS) credentials to access the LLM services.
Among the tools used is an open-source Python script that checks and validates keys for various offerings from Anthropic, AWS Bedrock, Google Cloud Vertex AI, Mistral, and OpenAI, among others.
"No legitimate LLM queries were actually run during the verification phase," Brucato explained. "Instead, just enough was done to figure out what the credentials were capable of and any quotas."
The keychecker also has integration with another open-source tool called oai-reverse-proxy that functions as a reverse proxy server for LLM APIs, indicating that the threat actors are likely providing access to the compromised accounts without actually exposing the underlying credentials.
"If the attackers were gathering an inventory of useful credentials and wanted to sell access to the available LLM models, a reverse proxy like this could allow them to monetize their efforts," Brucato said.
Furthermore, the attackers have been observed querying logging settings in a likely attempt to sidestep detection when using the compromised credentials to run their prompts.
The development is a departure from attacks that focus on prompt injections and model poisoning, instead allowing attackers to monetize their access to the LLMs while the owner of the cloud account foots the bill without their knowledge or consent.
Sysdig said that an attack of this kind could rack up over $46,000 in LLM consumption costs per day for the victim.
"The use of LLM services can be expensive, depending on the model and the amount of tokens being fed to it," Brucato said. "By maximizing the quota limits, attackers can also block the compromised organization from using models legitimately, disrupting business operations."
Organizations are recommended to enable detailed logging and monitor cloud logs for suspicious or unauthorized activity, as well as ensure that effective vulnerability management processes are in place to prevent initial access.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2024/05/researchers-uncover-llmjacking-scheme.html