PT-2024-18163 · Unknown · Parisneo/Lollms-Webui

Published 2024-04-10 · Updated 2024-04-10 · CVE-2024-1602

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions parisneo/lollms-webui (affected versions not specified)

Description The issue arises due to inadequate sanitization and validation of model output data, allowing an attacker to inject malicious JavaScript code. This code can be executed within the user's browser context, enabling the attacker to send a request to the "/execute code" endpoint and establish a reverse shell to the attacker's host. The issue affects various components of the application, including the handling of user input and model output.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider disabling the functionality that handles user input and model output to minimize the risk of exploitation. Restrict access to the "/execute code" endpoint to prevent potential attacks. Avoid using the application until a patch is available.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-1602

Affected Products

Parisneo/Lollms-Webui

References · 6

• 🔥 https://huntr.com/bounties/59be0d5a-f18e-4418-8f29-72320269a097 · Exploit
• https://osv.dev/vulnerability/CVE-2024-1602 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-1602 · Security Note
• https://twitter.com/CVEnew/status/1778118889404068161 · Twitter Post
• https://t.me/cvenotify/76303 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1778132099981066343 · Twitter Post