// For flags

CVE-2024-2359

Improper Neutralization of Special Elements used in an OS Command in parisneo/lollms-webui

Severity Score

9.8
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Attend
*SSVC
Descriptions

A vulnerability in the parisneo/lollms-webui version 9.3 allows attackers to bypass intended access restrictions and execute arbitrary code. The issue arises from the application's handling of the `/execute_code` endpoint, which is intended to be blocked from external access by default. However, attackers can exploit the `/update_setting` endpoint, which lacks proper access control, to modify the `host` configuration at runtime. By changing the `host` setting to an attacker-controlled value, the restriction on the `/execute_code` endpoint can be bypassed, leading to remote code execution. This vulnerability is due to improper neutralization of special elements used in an OS command (`Improper Neutralization of Special Elements used in an OS Command`).

Una vulnerabilidad en la versión 9.3 de parisneo/lollms-webui permite a los atacantes eludir las restricciones de acceso previstas y ejecutar código arbitrario. El problema surge del manejo por parte de la aplicación del endpoint `/execute_code`, que está manipulado para bloquear el acceso externo de forma predeterminada. Sin embargo, los atacantes pueden aprovechar el endpoint `/update_setting`, que carece de control de acceso adecuado, para modificar la configuración del `host` en tiempo de ejecución. Al cambiar la configuración de `host` a un valor controlado por el atacante, se puede eludir la restricción en el endpoint `/execute_code`, lo que lleva a la ejecución remota de código. Esta vulnerabilidad se debe a una neutralización inadecuada de elementos especiales utilizados en un comando del sistema operativo ("Neutralización inadecuada de elementos especiales utilizados en un comando del sistema operativo").

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Complete
Integrity
Complete
Availability
Complete
* Common Vulnerability Scoring System
SSVC
  • Decision:Attend
Exploitation
Poc
Automatable
Yes
Tech. Impact
Total
* Organization's Worst-case Scenario
Timeline
  • 2024-03-09 CVE Reserved
  • 2024-06-06 CVE Published
  • 2024-08-01 CVE Updated
  • 2024-12-17 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Lollms
Search vendor "Lollms"
 Lollms Web Ui
Search vendor "Lollms" for product "Lollms Web Ui"
*-
Affected
Parisneo
Search vendor "Parisneo"
 Lollms-webui
Search vendor "Parisneo" for product "Lollms-webui"
*-
Affected