PT-2024-19596 · Lollms · Lollms

Published 2024-06-06 · Updated 2024-10-15 · CVE-2024-2288

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:H

Name of the Vulnerable Software and Affected Versions Lollms versions up to 7.3.0

Description A Cross-Site Request Forgery (CSRF) vulnerability exists in the profile picture upload functionality of the Lollms application. This vulnerability allows attackers to change a victim's profile picture without their consent, potentially leading to a denial of service by overloading the filesystem with files. Additionally, this flaw can be exploited to perform a stored cross-site scripting (XSS) attack, enabling attackers to execute arbitrary JavaScript in the context of the victim's browser session.

Recommendations For versions up to 7.3.0, update to version 9.3 or higher to resolve the issue. As a temporary workaround, consider disabling the profile picture upload functionality until a patch is available. Restrict access to the profile picture upload feature to minimize the risk of exploitation.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2024-2288

Affected Products

Lollms

References · 7

• 🔥 https://huntr.com/bounties/2a37ae0c-890a-401a-8f3c-a261f3006290 · Exploit
• https://github.com/parisneo/lollms-webui/commit/ed085e6effab2b1e25ba2b00366a16ff67d8551b · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-2288 · Security Note
• https://osv.dev/vulnerability/CVE-2024-2288 · Vendor Advisory
• https://twitter.com/CVEnew/status/1798786688451490045 · Twitter Post
• https://twitter.com/CveFindCom/status/1798784906434163083 · Twitter Post
• https://t.me/cvenotify/98193 · Telegram Post