Back

CVE-2024-4326

May 16, 2024, 1:03 p.m.

Awaiting Analysis
CVE has been recently published to the CVE List and has been received by the NVD.

Products

parisneo/lollms-webui

  • up to 9.3

Source

security@huntr.dev

Tags

security@huntr.dev
2024-05-16
CVE-2024-4326
CWE-15

CVE-2024-4326 details

Published : May 16, 2024, 9:15 a.m.
Last Modified : May 16, 2024, 1:03 p.m.

Description

A vulnerability in parisneo/lollms-webui versions up to 9.3 allows remote attackers to execute arbitrary code. The vulnerability stems from insufficient protection of the `/apply_settings` and `/execute_code` endpoints. Attackers can bypass protections by setting the host to localhost, enabling code execution, and disabling code validation through the `/apply_settings` endpoint. Subsequently, arbitrary commands can be executed remotely via the `/execute_code` endpoint, exploiting the delay in settings enforcement. This issue was addressed in version 9.5.

CVSS Score

1 2 3 4 5 6 7 8 9.8 10

Weakness

Weakness Name Description

CVSS Data

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

Base Score

9.8

Exploitability Score

Impact Score

Base Severity

CRITICAL

Vector String : CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

URL Source
https://github.com/parisneo/lollms-webui/commit/abb4c6d495a95a3ef5b114ffc57f85cd650b905e security@huntr.dev
https://huntr.com/bounties/2ab9f03d-0538-4317-be21-0748a079cbdd security@huntr.dev
This website uses the NVD API, but is not approved or certified by it.