PT-2024-30422 · Parisneo · Lollms-Webui

Published 2024-05-16 · Updated 2024-05-16 · CVE-2024-4326

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions parisneo/lollms-webui versions up to 9.3

Description A vulnerability allows remote attackers to execute arbitrary code due to insufficient protection of the "/apply settings" and "/execute code" endpoints. Attackers can bypass protections by setting the host to localhost, enabling code execution, and disabling code validation through the "/apply settings" endpoint. Subsequently, arbitrary commands can be executed remotely via the "/execute code" endpoint, exploiting the delay in settings enforcement.

Recommendations For versions up to 9.3, update to version 9.5 to resolve the issue. As a temporary workaround, consider restricting access to the "/apply settings" and "/execute code" endpoints to minimize the risk of exploitation. Additionally, avoid setting the host to localhost and ensure code validation is enabled until the issue is resolved.

Fix

Weakness Enumeration

CWE-15

Related Identifiers

CVE-2024-4326

Affected Products

Lollms-Webui

References · 4

• https://github.com/parisneo/lollms-webui/commit/abb4c6d495a95a3ef5b114ffc57f85cd650b905e · Patch
• https://huntr.com/bounties/2ab9f03d-0538-4317-be21-0748a079cbdd · Patch
• https://osv.dev/vulnerability/CVE-2024-4326 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-4326 · Security Note