PT-2025-12321 · Unknown · Parisneo/Lollms-Webui
Published
2025-03-20
·
Updated
2025-03-27
·
CVE-2025-1451
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
parisneo/lollms-webui version v13
Description
A vulnerability arises from the server's handling of multipart boundaries in file uploads. The server does not limit or validate the length of the boundary or the characters appended to it, allowing an attacker to craft requests with excessively long boundaries, leading to resource exhaustion and eventual denial of service (DoS). Despite an attempted patch in commit 483431bb, which blocked hyphen characters from being appended to the multipart boundary, the fix is insufficient. The server remains vulnerable if other characters (e.g., '4','a') are used instead of hyphens. This allows attackers to exploit the vulnerability using different characters, causing resource exhaustion and service unavailability.
Recommendations
As a temporary workaround, consider restricting the length of multipart boundaries in file uploads to prevent resource exhaustion.
Restrict access to the file upload functionality to minimize the risk of exploitation until a proper fix is available.
Avoid using characters that can be used to bypass the attempted patch (e.g., '4','a') in the multipart boundary.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
DoS
Resource Exhaustion
Allocation of Resources Without Limits
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Parisneo/Lollms-Webui