CVE-2024-3126 Command Injection in parisneo/lollms-webui
Attackers can execute arbitrary commands remotely by manipulating the xtts_base_url parameter in the Lollms Web UI application.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-3126?
CVE-2024-3126 is a high-severity command injection vulnerability in parisneo/lollms-webui, published on 16 May 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A command injection vulnerability exists in the 'run_xtts_api_server' function of the parisneo/lollms-webui application, specifically within the 'lollms_xtts.py' script. The vulnerability arises due to the improper neutralization of special elements used in an OS command. The affected function utilizes 'subprocess.Popen' to execute a command constructed with a Python f-string, without adequately sanitizing the 'xtts_base_url' input. This flaw allows attackers to execute arbitrary commands remotely by manipulating the 'xtts_base_url' parameter. The vulnerability affects versions up to and including the latest version before 9.5. Successful exploitation could lead to arbitrary remote code execution (RCE) on the system where the application is deployed.
Weakness: CWE-78
Which versions are affected by CVE-2024-3126?
It affects 1 product.
Products include Lollms Lollms Web Ui.
How do I fix CVE-2024-3126?
No fix has been published for CVE-2024-3126 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2024-3126 being exploited?
There is no known exploitation of CVE-2024-3126 in the wild and no public exploit code.
Other vulnerabilities in parisneo/lollms-webui
- CVE-2024-2359 Improper Neutralization of Special Elements used in an OS Command in parisneo/lollms-webui
- CVE-2024-2360 Path Traversal leading to Remote Code Execution in parisneo/lollms-webui
- CVE-2024-4320 Remote Code Execution due to LFI in '/install_extension' in parisneo/lollms-webui
- CVE-2024-2358 Path Traversal leading to Remote Code Execution in parisneo/lollms-webui
- CVE-2024-4326 Remote Code Execution via `/apply_settings` and `/execute_code` in parisneo/lollms-webui
Sources
Also known as GHSA-6w8c-vq68-25hc.