Back

CVE-2024-4897

July 2, 2024, 5:44 p.m.

Awaiting Analysis
CVE has been recently published to the CVE List and has been received by the NVD.

Products

parisneo/lollms-webui

  • latest version

llama-cpp-python

  • llama_cpp_python-0.2.61+cpuavx2-cp311-cp311-manylinux_2_31_x86_64

Source

security@huntr.dev

Tags

security@huntr.dev
CWE-76
2024-07-02
CVE-2024-4897

CVE-2024-4897 details

Published : July 2, 2024, 3:15 p.m.
Last Modified : July 2, 2024, 5:44 p.m.

Description

parisneo/lollms-webui, in its latest version, is vulnerable to remote code execution due to an insecure dependency on llama-cpp-python version llama_cpp_python-0.2.61+cpuavx2-cp311-cp311-manylinux_2_31_x86_64. The vulnerability arises from the application's 'binding_zoo' feature, which allows attackers to upload and interact with a malicious model file hosted on hugging-face, leading to remote code execution. The issue is linked to a known vulnerability in llama-cpp-python, CVE-2024-34359, which has not been patched in lollms-webui as of commit b454f40a. The vulnerability is exploitable through the application's handling of model files in the 'bindings_zoo' feature, specifically when processing gguf format model files.

CVSS Score

1 2 3 4 5 6 7 8.4 9 10

Weakness

Weakness Name Description
CWE-76 Improper Neutralization of Equivalent Special Elements The product correctly neutralizes certain special elements, but it improperly neutralizes equivalent special elements.

CVSS Data

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

Base Score

8.4

Exploitability Score

2.5

Impact Score

5.9

Base Severity

HIGH

Vector String : CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

URL Source
https://huntr.com/bounties/ecf386df-4b6a-40b2-9000-db0974355acc security@huntr.dev
This website uses the NVD API, but is not approved or certified by it.