CVE-2024-2299 Stored Cross-Site Scripting (XSS) via Profile Picture Upload in parisneo/lollms-webui
Attackers can inject malicious scripts via profile picture uploads, leading to session hijacking and data theft in Lollms Web UI.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2024-2299?
CVE-2024-2299 is a high-severity cross-site scripting vulnerability in parisneo/lollms-webui, published on 12 May 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A stored Cross-Site Scripting (XSS) vulnerability exists in the parisneo/lollms-webui application due to improper validation of uploaded files in the profile picture upload functionality. Attackers can exploit this vulnerability by uploading malicious HTML files containing JavaScript code, which is executed when the file is accessed. This vulnerability is remotely exploitable via Cross-Site Request Forgery (CSRF), allowing attackers to perform actions on behalf of authenticated users and potentially leading to unauthorized access to sensitive information within the Lollms-webui application.
Weakness: CWE-79
Which versions are affected by CVE-2024-2299?
It affects 1 product.
Products include Lollms Lollms Web Ui.
How do I fix CVE-2024-2299?
No fix has been published for CVE-2024-2299 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2024-2299 being exploited?
There is no known exploitation of CVE-2024-2299 in the wild and no public exploit code.
Other vulnerabilities in parisneo/lollms-webui
- CVE-2024-2359 Improper Neutralization of Special Elements used in an OS Command in parisneo/lollms-webui
- CVE-2024-2360 Path Traversal leading to Remote Code Execution in parisneo/lollms-webui
- CVE-2024-4320 Remote Code Execution due to LFI in '/install_extension' in parisneo/lollms-webui
- CVE-2024-2358 Path Traversal leading to Remote Code Execution in parisneo/lollms-webui
- CVE-2024-4326 Remote Code Execution via `/apply_settings` and `/execute_code` in parisneo/lollms-webui
Sources
Also known as GHSA-cv4r-v8vp-fgjg.