Vulnerability Description
A remote code execution (RCE) vulnerability exists in the '/install_extension' endpoint of the parisneo/lollms-webui application, specifically within the `@router.post("/install_extension")` route handler. The vulnerability arises due to improper handling of the `name` parameter in the `ExtensionBuilder().build_extension()` method, which allows for local file inclusion (LFI) leading to arbitrary code execution. An attacker can exploit this vulnerability by crafting a malicious `name` parameter that causes the server to load and execute a `__init__.py` file from an arbitrary location, such as the upload directory for discussions. This vulnerability affects the latest version of parisneo/lollms-webui and can lead to remote code execution without requiring user interaction, especially when the application is exposed to an external endpoint or operated in headless mode.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Lollms | Lollms Web Ui | - |
Related Weaknesses (CWE)
References
- https://huntr.com/bounties/d6564f04-0f59-4686-beb2-11659342279bExploitThird Party Advisory
- https://huntr.com/bounties/d6564f04-0f59-4686-beb2-11659342279bExploitThird Party Advisory
FAQ
What is CVE-2024-4320?
CVE-2024-4320 is a vulnerability with a CVSS score of 9.8 (CRITICAL). A remote code execution (RCE) vulnerability exists in the '/install_extension' endpoint of the parisneo/lollms-webui application, specifically within the `@router.post("/install_extension")` route han...
How severe is CVE-2024-4320?
CVE-2024-4320 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2024-4320?
Check the references section above for vendor advisories and patch information. Affected products include: Lollms Lollms Web Ui.