Remote Code Execution Vulnerability in Parisneo/Lollms-Webui

CVE-2024-2359

Summary

A vulnerability in the Parisneo Lollms Web UI version 9.3 has been identified, allowing attackers to bypass intended access restrictions and execute arbitrary code. This issue stems from the misconfiguration in handling the /execute_code endpoint, which should be protected from external access. Attackers can exploit the poorly secured /update_setting endpoint to alter the runtime host configuration. By directing the host setting to malicious values, they can circumvent the defenses surrounding the /execute_code endpoint, resulting in unauthorized remote code execution. This situation arises due to improper neutralization of special elements used within OS commands, highlighting critical gaps in the application's security measures.

References