Description
Ollama before 0.1.34 is vulnerable to a path traversal attack via the model pull mechanism (CVE-2024-37032). When pulling a model, the digest field in OCI manifests is not validated, allowing an attacker to inject path traversal sequences to write arbitrary files on the server.
This module starts a rogue OCI registry that serves two models. The first pull writes a malicious shared library and /etc/ld.so.preload via path traversal (a sacrificial first layer absorbs the digest verification failure so the remaining files persist). The second pull registers a valid model so /api/chat can spawn the llama.cpp runner process, which triggers the dynamic linker to load the malicious library via ld.so.preload. The library constructor forks, cleans up ld.so.preload, and executes the payload in the child process.
The default Ollama Docker image runs as root with the API bound to 0.0.0.0:11434, making this a direct unauthenticated RCE.
Module options
To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':
msf > use exploit/linux/http/ollama/rce_cve_2024_37032msf undefined(rce_cve_2024_37032) > show actions ...actions...msf undefined(rce_cve_2024_37032) > set ACTION < action-name >msf undefined(rce_cve_2024_37032) > show options ...show and set options...msf undefined(rce_cve_2024_37032) > runPrioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub