THREATINT

We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Zendesk (Helpdesk and Chat)

Ok

PUBLISHED

CVE-2024-4320

Remote Code Execution due to LFI in '/install_extension' in parisneo/lollms-webui

Assigner:@huntr_ai (c09c270a-b464-47c1-9133-acb35b22c19a)
Reserved:2024-04-29
Published:2024-06-06
Updated:2024-06-07

Description

A remote code execution (RCE) vulnerability exists in the '/install_extension' endpoint of the parisneo/lollms-webui application, specifically within the `@router.post("/install_extension")` route handler. The vulnerability arises due to improper handling of the `name` parameter in the `ExtensionBuilder().build_extension()` method, which allows for local file inclusion (LFI) leading to arbitrary code execution. An attacker can exploit this vulnerability by crafting a malicious `name` parameter that causes the server to load and execute a `__init__.py` file from an arbitrary location, such as the upload directory for discussions. This vulnerability affects the latest version of parisneo/lollms-webui and can lead to remote code execution without requiring user interaction, especially when the application is exposed to an external endpoint or operated in headless mode.



CRITICAL: 9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Problem types

CWE-29 Path Traversal: '\..\filename'

Product status

Any version
affected

References

https://huntr.com/bounties/d6564f04-0f59-4686-beb2-11659342279b

cve.org CVE-2024-4320

nvd.nist.gov CVE-2024-4320

Download JSON

Share this page
https://cve.threatint.com/CVE/CVE-2024-4320