Stable Diffusion WebUI vulnerabilities

A vulnerability was found in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. It impacts read_metadata_from_safetensors in modules/sd_models.py of the Metadata Extraction component. Manipulating the header length field results in resource allocation, the attack can be launched remotely, and the exploit has been made public. The project was informed but has not responded yet.

A vulnerability has been found in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. It affects create_item_html in modules/ui_extra_networks.py of the Card Builder component. Manipulating the filename argument leads to cross site scripting, the attack can be initiated remotely, and the exploit has been disclosed publicly. The project was informed but has not responded yet.

Stable Diffusion WebUI through 1.10.1 contains a credential disclosure vulnerability in the /sdapi/v1/cmd-flags endpoint that returns parsed command-line arguments including gradio_auth and api_auth values in cleartext. Unauthenticated attackers can access this endpoint to retrieve configured usernames and passwords, then use them to authenticate to the interface and access the application.

to_abs_path in scripts/iib/tool.py normalizes the path with os.path.normpath, which does not resolve symbolic links. A symlink placed inside a scanned directory can point outside that directory, and FileResponse follows the link, disclosing files such as /etc/passwd.

is_path_trusted in scripts/iib/api.py compares the requested path against allowed parent directories with path.startswith(parent_path), without appending a path separator. A directory whose name merely begins with an allowed path satisfies the comparison, allowing access to files outside the allowed directory.