CVE-2024-5125 XSS and Open Redirect via SVG File Upload in parisneo/lollms-webui
Attackers can execute malicious scripts or redirect users via uploaded SVG files in lollms-webui, risking credential theft and phishing.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2024-5125?
CVE-2024-5125 is a high-severity cross-site scripting vulnerability in parisneo/lollms-webui, published on 14 Nov 2024. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
parisneo/lollms-webui version 9.6 is vulnerable to Cross-Site Scripting (XSS) and Open Redirect due to inadequate input validation and processing of SVG files during the upload process. The XSS vulnerability allows attackers to embed malicious JavaScript code within SVG files, which is executed upon rendering, leading to potential credential theft and unauthorized data access. The Open Redirect vulnerability arises from insufficient URL validation within SVG files, enabling attackers to redirect users to malicious websites, thereby exposing them to phishing attacks, malware distribution, and reputation damage. These vulnerabilities are present in the application's functionality to send files to the AI module.
Weakness: CWE-79
Which versions are affected by CVE-2024-5125?
It affects 1 product.
Products include Lollms Lollms-Webui.
How do I fix CVE-2024-5125?
No fix has been published for CVE-2024-5125 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2024-5125 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-5125 exists.
Other vulnerabilities in parisneo/lollms-webui
- CVE-2024-4267 Remote Code Execution in parisneo/lollms-webui
- CVE-2024-1646 Authentication Bypass in parisneo/lollms-webui
- CVE-2024-1601 SQL Injection in parisneo/lollms-webui
- CVE-2024-1569 Uncontrolled Resource Consumption in parisneo/lollms-webui
- CVE-2024-4839 CSRF in Servers Configurations in parisneo/lollms-webui
Sources
Also known as GHSA-8p2m-96j6-h5p5.