Cross-Site WebSocket Hijacking Vulnerability in Automatic1111's Stable Diffusion Web UI
CVE-2024-11045

9.6CRITICAL

Key Information:

Vendor

Automatic1111

Status
Automatic1111/stable-diffusion-webui
Vendor
CVE Published:
20 March 2025

What is CVE-2024-11045?

A Cross-Site WebSocket Hijacking vulnerability in Automatic1111's Stable Diffusion Web UI version 1.10.0 allows attackers to exploit insufficient validation of WebSocket connections at ws://127.0.0.1:7860/queue/join. This flaw can enable unauthorized actions on the server, such as cloning malicious server extensions from GitHub repositories, executing harmful scripts, exfiltrating sensitive data, and potentially causing denial of service (DoS) attacks.

Affected Version(s)

automatic1111/stable-diffusion-webui <= unspecified

References

https://huntr.com/bounties/b7ed0d87-0be5-4526-9b21-ffe0d3...

CVSS V3.0

Score:
9.6
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.