CVE-2024-1602 Stored XSS leading to RCE in parisneo/lollms-webui
Stored XSS in Lollms Web UI allows attackers to inject JavaScript, leading to remote code execution via the execute_code endpoint.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2024-1602?
CVE-2024-1602 is a high-severity cross-site scripting vulnerability in parisneo/lollms-webui, published on 10 Apr 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
parisneo/lollms-webui is vulnerable to stored Cross-Site Scripting (XSS) that leads to Remote Code Execution (RCE). The vulnerability arises due to inadequate sanitization and validation of model output data, allowing an attacker to inject malicious JavaScript code. This code can be executed within the user's browser context, enabling the attacker to send a request to the `/execute_code` endpoint and establish a reverse shell to the attacker's host. The issue affects various components of the application, including the handling of user input and model output.
Weakness: CWE-79
Which versions are affected by CVE-2024-1602?
It affects 1 product.
Products include Lollms Lollms Web Ui.
How do I fix CVE-2024-1602?
No fix has been published for CVE-2024-1602 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2024-1602 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-1602 exists.
Other vulnerabilities in parisneo/lollms-webui
- CVE-2024-2359 Improper Neutralization of Special Elements used in an OS Command in parisneo/lollms-webui
- CVE-2024-2360 Path Traversal leading to Remote Code Execution in parisneo/lollms-webui
- CVE-2024-4320 Remote Code Execution due to LFI in '/install_extension' in parisneo/lollms-webui
- CVE-2024-2358 Path Traversal leading to Remote Code Execution in parisneo/lollms-webui
- CVE-2024-4326 Remote Code Execution via `/apply_settings` and `/execute_code` in parisneo/lollms-webui
Sources
Also known as GHSA-jmw2-399f-6mwg.