Description
Ollama 是一款软件工具，在版本 0.1.34 之前的版本中，未对获取模型路径时的摘要格式（sha256 和 64 个十六进制字符）进行验证。这导致了对测试用例的错误处理，例如少于 64 个十六进制字符、多于 64 个十六进制字符或以 ../ 开头的子字符串。攻击者可以利用此漏洞实现远程代码执行。
Ollama /api/pull 代码执行漏洞（CVE-2024-37032）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://github.com/Threekiii/Vulnerability-Wiki/blob/master/docs-base/docs/ai/Ollama-%E7%9B%AE%E5%BD%95%E9%81%8D%E5%8E%86%E8%87%B4%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E-CVE-2024-37032.md
https://blog.csdn.net/rnn9storyteller/article/details/153857141
https://www.ctfiot.com/227406.html
https://cloud.tencent.com/developer/article/2656367
https://avd.aliyun.com/detail?id=AVD-2024-37032
https://www.venustech.com.cn/new_type/aqtg/20240628/27720.html
https://nvd.nist.gov/vuln/detail/cve-2024-37032
https://www.wiz.io/blog/probllama-ollama-vulnerability-cve-2024-37032
https://www.vicarius.io/vsociety/posts/probllama-in-ollama-a-tale-of-a-yet-another-rce-vulnerability-cve-2024-37032