PT-2024-36425 · Parisneo · Lollms-Webui

Published 2024-06-06 · Updated 2024-10-09 · CVE-2024-5482

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions parisneo/lollms-webui version latest

Description A Server-Side Request Forgery (SSRF) vulnerability exists in the "add webpage" endpoint, allowing attackers to input arbitrary URLs, including those targeting internal resources such as localhost or 127.0.0.1. This enables unauthorized requests to internal or external systems, potentially leading to access to sensitive data, service disruption, network integrity compromise, business logic manipulation, and abuse of third-party resources. The issue is critical and requires immediate attention.

Recommendations As a temporary workaround, consider disabling the add webpage endpoint until a patch is available. Restrict access to internal resources such as localhost and 127.0.0.1 to minimize the risk of exploitation. Avoid using the add webpage endpoint with arbitrary URLs until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2024-5482

Affected Products

Lollms-Webui

References · 5

• 🔥 https://huntr.com/bounties/d97e23e7-172f-4862-a732-86bfc0b7860e · Exploit
• https://osv.dev/vulnerability/CVE-2024-5482 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-5482 · Security Note
• https://t.me/cvenotify/97648 · Telegram Post
• https://twitter.com/CVEnew/status/1798781388080173472 · Twitter Post