Server-Side Request Forgery Vulnerability in parisneo/lollms-webui

CVE-2024-12766

Summary

The parisneo/lollms-webui version V13 (feather) contains a Server-Side Request Forgery (SSRF) vulnerability in the POST /api/proxy REST API endpoint. This vulnerability allows attackers to leverage the server’s own credentials, enabling unauthorized access to internal web resources by manipulating the JSON parameter, such as {"url":"http://steal.target"}. Notably, existing protective measures, including forbid_remote_access(lollmsElfServer), lollmsElfServer.config.headless_server_mode, and check_access(lollmsElfServer, request.client_id), do not mitigate this issue, highlighting a critical need for improved security protocols within the application.

References