CyberRota Analysis
AI-GeneratedThe vulnerability in LightLLM versions up to 1.2.0 allows unauthenticated attackers to exploit the /pd_register WebSocket endpoint, enabling them to register arbitrary nodes through crafted JSON input without proper peer address validation. This can lead to severe impacts, including unauthorized access to user prompts, denial of service by replacing legitimate nodes, and the potential for internal network requests to be issued by the PD Master. Organizations using this software should prioritize patching this vulnerability due to its critical severity and the high risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
LightLLM through 1.2.0 contains an authentication bypass vulnerability in the /pd_register WebSocket endpoint that allows unauthenticated attackers to register arbitrary nodes by supplying crafted JSON without peer address validation. Attackers can disclose full user prompts routed to their socket, trigger denial of service by replacing legitimate nodes, or make the PD Master issue requests to internal network addresses.