Parisneo Lollms-Webui Vulnerability Leads to Denial of Service and Remote Exploitation

CVE-2024-6959

Summary

A Denial of Service (DoS) vulnerability exists in version 9.8 of lollms-webui from Parisneo that can be triggered through the upload of an audio file with an excessive number of characters appended to the multipart boundary. This manipulation leads to continuous processing by the system, making lollms-webui unavailable to users. The absence of Cross-Site Request Forgery (CSRF) protection further complicates this issue, allowing attackers to exploit the flaw remotely. The result is significant service disruption and resource depletion, which can lead to prolonged downtime and negatively impact the availability of the service.

References