PT-2024-31349 · Lollms+1 · Lollms+2

Published 2024-06-24 · Updated 2024-09-13 · CVE-2024-4499

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions lollms version 9.6

Description A Cross-Site Request Forgery (CSRF) vulnerability exists in the XTTS server due to a lax CORS policy, allowing attackers to perform unauthorized actions by tricking a user into visiting a malicious webpage. This can trigger arbitrary LoLLMS-XTTS API requests, leading to the reading and writing of audio files. When combined with other vulnerabilities, it could allow for the reading of arbitrary files on the system and writing files outside the permitted audio file location.

Recommendations For version 9.6, consider implementing a stricter CORS policy to prevent unauthorized API requests as a temporary workaround. Restrict access to the XTTS server to minimize the risk of exploitation. Avoid using the LoLLMS-XTTS API for sensitive operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2024-4499

Affected Products

Lollms-Xtts Api

Xtts Server

Lollms

References · 5

• 🔥 https://huntr.com/bounties/336cd0eb-eb47-450d-9b2c-9332f69af65a · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-4499 · Security Note
• https://osv.dev/vulnerability/CVE-2024-4499 · Vendor Advisory
• https://t.me/cvenotify/84137 · Telegram Post
• https://t.me/cvenotify/94522 · Telegram Post