PT-2025-12241 · Unknown · Parisneo/Lollms-Webui

Published 2025-03-20 · Updated 2025-04-04 · CVE-2024-8736

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

Name of the Vulnerable Software and Affected Versions parisneo/lollms-webui version V12 (Strawberry)

Description A Denial of Service (DoS) issue exists due to the application's handling of multipart boundaries in file upload endpoints. Despite CSRF protection, the server processes these boundaries, leading to resource exhaustion. An attacker can exploit this by appending characters to the multipart boundary, causing the server to parse each byte and resulting in service unavailability. The issue affects the "/upload avatar", "/upload app", and "/upload logo" endpoints.

Recommendations For parisneo/lollms-webui version V12 (Strawberry), consider disabling the file upload functionality in the "/upload avatar", "/upload app", and "/upload logo" endpoints until a patch is available to prevent exploitation. Restrict access to these endpoints to minimize the risk of resource exhaustion. Avoid processing multipart boundaries in these endpoints to mitigate the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Resource Exhaustion

CSRF

Weakness Enumeration

CWE-400

CWE-352

Related Identifiers

CVE-2024-8736

Affected Products

Parisneo/Lollms-Webui

References · 7

• 🔥 https://huntr.com/bounties/935dbc03-1b43-4dbb-b6cd-1aa95a789d4f · Exploit
• https://osv.dev/vulnerability/CVE-2024-8736 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-8736 · Security Note
• https://twitter.com/SecurtyRating/status/1908094907090166045 · Twitter Post
• https://twitter.com/AyushInfo57268/status/1908095566430474353 · Twitter Post
• https://twitter.com/CVEnew/status/1902670997582471540 · Twitter Post
• https://t.me/cvenotify/117717 · Telegram Post