利用 LLM 和静态代码分析识别可远程利用漏洞的工具。
全球首个由 AI 自主发现的 0day 漏洞
Vulnhuntr 利用 LLM 的强大能力，自动构建并分析从远程用户输入开始、到服务器输出结束的完整代码调用链，以检测复杂的、多步骤的、能够绕过安全防护的漏洞，其能力远超传统静态代码分析工具。在此查看所有细节，包括 Vulnhuntr 对所有 0day 漏洞的输出：Protect AI Vulnhuntr 博客
[!TIP] 使用 Vulnhuntr 发现了漏洞？向 huntr.com 提交报告即可获得赏金，并提交 PR 将其添加到下方列表中！
[!NOTE] 此表仅是迄今已发现漏洞的一部分示例。我们将在相关负责任披露期结束后逐步公开详细信息。
| 仓库 | Stars | 漏洞 |
|---|---|---|
| gpt_academic | 67k | LFI、XSS |
| ComfyUI | 66k | XSS |
| Langflow | 46k | RCE、IDOR |
| FastChat | 37k | SSRF |
| Ragflow | 31k | RCE |
| LLaVA | 21k | SSRF |
| gpt-researcher | 17k | AFO |
| Letta | 14k | AFO |
[!IMPORTANT] Vulnhuntr 严格要求使用 Python 3.10，因为其用于解析 Python 代码的 Jedi 存在多个 Bug。若使用其他 Python 版本安装，将无法可靠运行。
我们建议使用 pipx 或 Docker 来轻松安装和运行 Vulnhuntr。
使用 Docker：
docker build -t vulnhuntr https://github.com/protectai/vulnhuntr.git#main
使用 pipx：
pipx install git+https://github.com/protectai/vulnhuntr.git --python python3.10
或者，您也可以使用 poetry 直接从源码安装：
git clone https://github.com/protectai/vulnhuntr
cd vulnhuntr && poetry install
该工具旨在分析 GitHub 仓库中潜在的可远程利用漏洞。使用该工具需要提供 API 密钥以及 GitHub 仓库的本地路径。您也可以选择为 LLM 服务指定自定义端点。
[!CAUTION] 请始终为您所使用的 LLM 提供商设置消费限额，或密切监控费用。该工具会尽可能多地将代码塞入 LLM 的上下文窗口，因此有可能产生高额账单。
[!TIP] 我们建议使用 Claude 作为 LLM。经过测试，其效果优于 GPT。
usage: vulnhuntr [-h] -r ROOT [-a ANALYZE] [-l {claude,gpt,ollama}] [-v]
Analyze a GitHub project for vulnerabilities. Export your ANTHROPIC_API_KEY/OPENAI_API_KEY before running.
options:
-h, --help show this help message and exit
-r ROOT, --root ROOT Path to the root directory of the project
-a ANALYZE, --analyze ANALYZE
Specific path or file within the project to analyze
-l {claude,gpt,ollama}, --llm {claude,gpt,ollama}
LLM client to use (default: claude)
-v, --verbosity Increase output verbosity (-v for INFO, -vv for DEBUG)
通过 pipx 安装后，使用 Claude 分析整个仓库：
export ANTHROPIC_API_KEY="sk-1234"
vulnhuntr -r /path/to/target/repo/
[!TIP] 我们建议为 Vulnhuntr 指定处理远程用户输入的特定文件，并逐一扫描这些文件。
通过 pipx 安装后，使用 GPT-4o 分析 /path/to/target/repo/server.py 文件。也可以指定子目录来代替单个文件：
export OPENAI_API_KEY="sk-1234"
vulnhuntr -r /path/to/target/repo/ -a server.py -l gpt
通过 Docker 安装后，使用 Claude 并通过自定义端点运行，以分析 /local/path/to/target/repo/repo-subfolder/target-file.py：
docker run --rm -e ANTHROPIC_API_KEY=sk-1234 -e ANTHROPIC_BASE_URL=https://localhost:1234/api -v /local/path/to/target/repo:/repo vulnhuntr:latest -r /repo -a repo-subfolder/target-file.py
实验性
Ollama 也作为可选项包含在内，不过我们尚未成功让开源模型正确结构化其输出。
export OLLAMA_BASE_URL=http://localhost:11434/api/generate
export OLLAMA_MODEL=llama3.2
vulnhuntr -r /path/to/target/repo/ -a server.py -l ollama
[!TIP] 通常，置信度评分低于 7 意味着不太可能存在漏洞。评分为 7 表示应进行调查，评分为 8 及以上则极有可能是真实漏洞。
该工具会生成一份关于所分析文件中发现漏洞的详细报告。报告包括：
以下是一个 Vulnhuntr 报告示例，描述了 Ragflow（现已修复）中的一个 0day 远程代码执行漏洞：
scratchpad:
1. Analyzing the add_llm function in llm_app.py. 2. Identified user input used as keys to access dictionaries: EmbeddingModel, ChatModel, RerankModel,
CvModel, and TTSModel. 3. These dictionaries contain class references, which are instantiated with user-supplied parameters. 4. The factory variable is
directly used from user input (req['llm_factory']) without proper validation. 5. The llm_name is also derived from user input in most cases. 6. The
instantiation of these classes occurs in try-except blocks, but exceptions are only used for error messages, not preventing execution. 7. The api_key
and other sensitive information are passed directly to these instantiated classes. 8. There's no comprehensive input validation or sanitization for the
factory or llm_name variables. 9. The vulnerability is in a route decorated with @login_required, indicating it's accessible to authenticated users. 10.
Reviewing the EmbeddingModel, ChatModel, RerankModel, CvModel, and TTSModel dictionaries to understand their contents and potential for exploitation.
----------------------------------------
analysis:
The add_llm function in llm_app.py contains a critical Remote Code Execution (RCE) vulnerability. The function uses user-supplied input
(req['llm_factory'] and req['llm_name']) to dynamically instantiate classes from the EmbeddingModel, ChatModel, RerankModel, CvModel, and TTSModel
dictionaries. This pattern of using user input as a key to access and instantiate classes is inherently dangerous, as it allows an attacker to
potentially execute arbitrary code. The vulnerability is exacerbated by the lack of comprehensive input validation or sanitization on these
user-supplied values. While there are some checks for specific factory types, they are not exhaustive and can be bypassed. An attacker could potentially
provide a malicious value for 'llm_factory' that, when used as an index to these model dictionaries, results in the execution of arbitrary code. The
vulnerability is particularly severe because it occurs in a route decorated with @login_required, suggesting it's accessible to authenticated users,
which might give a false sense of security.
----------------------------------------
poc:
POST /add_llm HTTP/1.1
Host: target.com
Content-Type: application/json
Authorization: Bearer <valid_token>
{
"llm_factory": "__import__('os').system",
"llm_name": "id",
"model_type": "EMBEDDING",
"api_key": "dummy_key"
}
This payload attempts to exploit the vulnerability by setting 'llm_factory' to a string that, when evaluated, imports the os module and calls system.
The 'llm_name' is set to 'id', which would be executed as a system command if the exploit is successful.
----------------------------------------
confidence_score:
8
----------------------------------------
vulnerability_types:
- RCE
----------------------------------------
该工具会将分析过程和结果记录到名为 vulnhuntr.log 的文件中。该文件包含分析每个步骤的详细信息，包括初步和二次评估。