Vulnerability · Published Mar 30, 2024 · Assigned by @huntr_ai
CVE-2024-1522Cross-Site Request Forgery (CSRF) Leading to Remote Code Execution in parisneo/lollms-webui
High 8.8
In plain English
A high-severity cross-site request forgery in parisneo/lollms-webui from parisneo. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities).
Official description
A Cross-Site Request Forgery (CSRF) vulnerability in the parisneo/lollms-webui project allows remote attackers to execute arbitrary code on a victim's system. The vulnerability stems from the `/execute_code` API endpoint, which does not properly validate requests, enabling an attacker to craft a malicious webpage that, when visited by a victim, submits a form to the victim's local lollms-webui instance to execute arbitrary OS commands. This issue allows attackers to take full control of the victim's system without requiring direct network access to the vulnerable application.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| parisneo | parisneo/lollms-webui | unspecified – before 9.2 |
Weakness: CWE-352 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H