Remote Code Execution Vulnerability in parisneo/lollms-webui

CVE-2024-4320

Summary

A remote code execution vulnerability has been identified in the parisneo/lollms-webui application, specifically within the '/install_extension' endpoint. The flaw is rooted in the mishandling of the 'name' parameter within the ExtensionBuilder() class method build_extension(). This security issue allows attackers to exploit local file inclusion, enabling them to execute arbitrary code. By manipulating the 'name' parameter, a malicious user can compel the server to load and execute a 'init.py' file from an uncontrolled directory, such as the upload directory. This vulnerability particularly poses a risk when the application is accessible through an external connection or is running in headless mode, as it permits remote code execution without any direct user interaction.

References