CVE-2024-5186Discovered Published
privateGPT SSRF via file upload
View patch bundle on GitHubFull published report
The reviewed summary below describes the scope of the fixture testing.
privateGPT SSRF via file upload (CVE-2024-5186)
cve.now entry. Product: privategpt (lab:
gabriel-privategpt).
Eden terminates the HTTP connection to the affected product, evaluates a declarative policy and — in tier 2 — a separately compiled native Rust module under signed module authority, before any byte reaches the application. It does not patch the affected component; the vendor's fixed release remains the durable repair.
Status: Remediated (tier 1 + tier 2), live-proven 2026-11-11T16:46:38Z on the
installed eden-product-release:1.103.0 lab container.
The vulnerability
The privateGPT file-upload path fetches a caller-supplied URL, so a crafted
upload can drive the server to internal services (metadata endpoints,
loopback agents). The fixture (fixtures9.py, make_pgpt) reproduces the
delivery shape: an upload whose url member points at
http://169.254.169.254/credentials records an internal-fetch mark.
The Eden patch
Tier 1 — declarative policy (blunt, fail-closed): deny every request under
/file/upload, legitimate uploads included — false positives measured below.
Tier 2 — native Rust module gabriel_pgpt_v1 (surgical): refuses upload
bodies whose URL carries loopback/link-local markers (169.254, 127.0.0.1,
localhost, ::1); relative-path uploads and ordinary external URLs pass
unchanged.
Measured comparison (fixtures9, run 2026-11-11)
| Probe | Baseline | Tier 1 | Tier 2 (module) | Backend effect |
|---|---|---|---|---|
benign upload {"url":"/data/report.csv"} | 200 | 403 (false positive) | 200 | none |
benign external URL http://192.0.2.2/report.csv | 200 | 403 (false positive) | 200 | none |
attack: metadata SSRF http://169.254.169.254/credentials | 200 (ssrf_internal recorded) | 403 | 403 | blocked at tier 2 |
Performance trace (Eden telemetry, live 2026-11-11)
Measured with Eden's built-in request telemetry (gateway.request.baseline
spans, read back through /api/v1/analytics/telemetry?signal=traces), not
client wall-clock. Latency Eden introduces per remediation arm for this case:
| Arm | n | mean | p50 | p95 | min–max |
|---|---|---|---|---|---|
| Tier 1 — declarative policy, blocked request (403) | 15 | 86 µs | 60 µs | 217 µs | 18 µs–217 µs |
| Tier 2 — native module, benign passes through (200) | 22 | 339 µs | 316 µs | 494 µs | 289 µs–629 µs |
| Tier 2 — native module, attack refused (403) | 14 | 136 µs | 128 µs | 216 µs | 107 µs–216 µs |
Eden-added latency for the tier-2 remediation: benign requests complete in 339 µs mean (p50 316 µs, p95 494 µs) in-product, module evaluation included. Honest scope: lab fixtures on one host, fresh connection per measured request, warm requests only; module reactivated shards 2/2 with a fresh signed statement per measurement; spans carry the full authority lineage (module SHA-256, operation, publication). Not the EDEN-3640 performance qualification contract.
Tested against: eden-product-release:1.103.0-single (image sha256:809293e1f0b525ac…, build target
eden_service_single, tooling revision 81a0724a…). Raw data:
module2/telemetry-ab/pgpt-telemetry.json and module2/tier1-ab/pgpt-tier1.json.
Authority lifecycle and negatives
Import 201, activation: explicit_required; publisher enroll_key, host
inventory + approve, reader inspect refused 403; tampered-statement admit
400; invalid-signature admit 403; admit prepared (not serving), activate
→ receipt serving_now, applied shards 2/2. Revoke → the identical attack
gets 503 (fail-closed); re-approve + re-activate → 403 again. All recorded
in the evidence JSON.
Honest scope
The fixture reproduces the delivery shape, not the full privateGPT upload
surface. Bypass variants (redirects, alternate URL fields, DNS rebinding) are
not bypass-tested; the rule is a lab-grade partial. Module binary SHA-256
a16c2caa…, source modules/gabriel_pgpt_v1.rs.
Cost record
Run window 16:46:38Z → 16:46:47Z (per-CVE ledger, marginal session cost).
Evidence appendix
- Fixture:
gabriel-2026-11-11/fixtures9.py(make_pgpt, port 18300) - Evidence:
gabriel-2026-11-11/module2/evidence/pgpt-module.json - Module source:
docs/case-studies/modules/gabriel_pgpt_v1.rs
The vulnerability
The privateGPT file-upload path fetches a caller-supplied URL, so a crafted
upload can drive the server to internal services (metadata endpoints,
loopback agents). The fixture (fixtures9.py, make_pgpt) reproduces the
delivery shape: an upload whose url member points at
the test URL records an internal-fetch mark.
The Eden patch
Tier 1 — declarative policy (blunt, fail-closed): deny every request under
/file/upload, legitimate uploads included — false positives measured below.
Tier 2 — native Rust module gabriel_pgpt_v1 (surgical): refuses upload
bodies whose URL carries loopback/link-local markers (169.254, 127.0.0.1,
localhost, ::1); relative-path uploads and ordinary external URLs pass
unchanged.
Measured comparison (fixtures9, run 2026-11-11)
| Probe | Baseline | Tier 1 | Tier 2 (module) | Backend effect |
|---|---|---|---|---|
benign upload {"url":"/data/report.csv"} | 200 | 403 (false positive) | 200 | none |
benign external URL the test URL | 200 | 403 (false positive) | 200 | none |
attack: metadata SSRF the test URL | 200 (ssrf_internal recorded) | 403 | 403 | blocked at tier 2 |
Performance trace (Eden telemetry, live 2026-11-11)
Measured with Eden's built-in request telemetry (gateway.request.baseline
spans, read back through /api/v1/analytics/telemetry?signal=traces), not
client wall-clock. Latency Eden introduces per remediation arm for this case:
| Arm | n | mean | p50 | p95 | min–max |
|---|---|---|---|---|---|
| Tier 1 — declarative policy, blocked request (403) | 15 | 86 µs | 60 µs | 217 µs | 18 µs–217 µs |
| Tier 2 — native module, benign passes through (200) | 22 | 339 µs | 316 µs | 494 µs | 289 µs–629 µs |
| Tier 2 — native module, attack refused (403) | 14 | 136 µs | 128 µs | 216 µs | 107 µs–216 µs |
Authority lifecycle and negatives
Import 201, activation: explicit_required; publisher enroll_key, host
inventory + approve, reader inspect refused 403; tampered-statement admit
400; invalid-signature admit 403; admit prepared (not serving), activate
→ receipt serving_now, applied shards 2/2. Revoke → the identical attack
gets 503 (fail-closed); re-approve + re-activate → 403 again. All recorded
in the evidence JSON.
Honest scope
The fixture reproduces the delivery shape, not the full privateGPT upload
surface. Bypass variants (redirects, alternate URL fields, DNS rebinding) are
not bypass-tested; the rule is a lab-grade partial. Module binary SHA-256
a16c2caa…, source modules/gabriel_pgpt_v1.rs.
Cost record
Run window 16:46:38Z → 16:46:47Z (per-CVE ledger, marginal session cost).