PT-2024-30366 · Unknown · Parisneo/Lollms-Webui

Published 2024-06-06 · Updated 2024-10-17 · CVE-2024-4320

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions parisneo/lollms-webui (affected versions not specified)

Description A remote code execution (RCE) vulnerability exists in the '/install extension' endpoint of the parisneo/lollms-webui application. The vulnerability arises due to improper handling of the name parameter in the ExtensionBuilder().build extension() method, which allows for local file inclusion (LFI) leading to arbitrary code execution. An attacker can exploit this vulnerability by crafting a malicious name parameter that causes the server to load and execute a init .py file from an arbitrary location. This can lead to remote code execution without requiring user interaction, especially when the application is exposed to an external endpoint or operated in headless mode.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

CWE-29

Related Identifiers

CVE-2024-4320

Affected Products

Parisneo/Lollms-Webui

References · 10

• 🔥 https://huntr.com/bounties/d6564f04-0f59-4686-beb2-11659342279b · Exploit
• https://osv.dev/vulnerability/CVE-2024-4320 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-4320 · Security Note
• https://twitter.com/CVEnew/status/1798786693203677690 · Twitter Post
• https://t.me/cvenotify/98633 · Telegram Post
• https://twitter.com/CveFindCom/status/1804552596486521343 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1798817988889776389 · Twitter Post
• https://t.me/cvenotify/84118 · Telegram Post
• https://twitter.com/CveFindCom/status/1798784778914648422 · Twitter Post
• https://twitter.com/CVEnew/status/1804549085954732423 · Twitter Post