Vulnerability · Published Jun 6, 2024 · Assigned by @huntr_ai
CVE-2024-4320Remote Code Execution due to LFI in '/install_extension' in parisneo/lollms-webui
Critical 9.8
In plain English
A critical-severity security flaw in parisneo/lollms-webui from parisneo. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 34.4% (higher than 98% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
A remote code execution (RCE) vulnerability exists in the '/install_extension' endpoint of the parisneo/lollms-webui application, specifically within the `@router.post("/install_extension")` route handler. The vulnerability arises due to improper handling of the `name` parameter in the `ExtensionBuilder().build_extension()` method, which allows for local file inclusion (LFI) leading to arbitrary code execution. An attacker can exploit this vulnerability by crafting a malicious `name` parameter that causes the server to load and execute a `__init__.py` file from an arbitrary location, such as the upload directory for discussions. This vulnerability affects the latest version of parisneo/lollms-webui and can lead to remote code execution without requiring user interaction, especially when the application is exposed to an external endpoint or operated in headless mode.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| parisneo | parisneo/lollms-webui | unspecified – through latest |
Weakness: CWE-29 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H