Unauthenticated Server-Side Request Forgery in OGX

OGX (formerly Llama Stack), up to commit fbe8e0f, contains a critical server-side request forgery (SSRF) vulnerability in its OpenAI-compatible POST /v1/responses endpoint. The vulnerability stems from the MCP tool definition processing logic, where the server_url parameter is fetched server-side without performing necessary destination validation. Specifically, the validate_url_not_private() guard, which is correctly implemented for other input fields, is omitted for the server_url parameter.

In default configurations that lack authentication, a remote, unauthenticated attacker can exploit this flaw to force the OGX server to initiate connections to arbitrary internal network resources. This includes sensitive cloud metadata endpoints such as 169.254.169.254. Furthermore, the vulnerability allows for the forwarding of attacker-supplied headers and bearer tokens to these internal destinations, potentially leading to unauthorized data exfiltration or internal system interaction. This vulnerability represents a high risk for deployments residing in cloud environments where metadata services contain IAM credentials or sensitive configuration information.

Impact

Successful exploitation allows unauthenticated remote attackers to bypass network perimeters and interact with internal-only services. In cloud-native deployments, this typically results in the exfiltration of sensitive cloud metadata (e.g., IAM role credentials, instance metadata), which can be leveraged for lateral movement or full compromise of the cloud account.

Recommendation

• Immediately update all OGX instances to a version beyond commit fbe8e0f.
• Implement strict network egress filtering on all servers hosting the OGX platform to prevent connections to internal IP ranges (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, and 169.254.169.254).
• Deploy the Sigma rule below to detect abnormal POST requests to the affected endpoint.
• Apply the following Sigma rule to your webserver access logs to identify exploitation attempts targeting the v1/responses endpoint.