CVE-2024-4320

🗓️ 06 Jun 2024 18:22:40Reported by @huntr_aiType

cve🔗 web.nvd.nist.gov👁 52 Views🌐 WEB

Remote code execution vulnerability in '/install_extension' endpoint of parisneo/lollms-webui app due to improper handling of 'name' parameter in 'build_extension()' method, enabling local file inclusion (LFI) and arbitrary code execution

Reporter	Title	Published	Views	Family All 12
CNNVD	LoLLMs Security Vulnerabilities	6 Jun 202400:00	–	cnnvd
Cvelist	CVE-2024-4320 Remote Code Execution due to LFI in '/install_extension' in parisneo/lollms-webui	6 Jun 202418:22	–	cvelist
Cvelist	CVE-2024-5443 Remote Code Execution via Path Traversal in parisneo/lollms	22 Jun 202416:12	–	cvelist
EUVD	EUVD-2024-2113	22 Jun 202416:12	–	euvd
Github Security Blog	Remote Code Execution via path traversal bypass in lollms	22 Jun 202418:30	–	github
NVD	CVE-2024-4320	6 Jun 202419:16	–	nvd
OSV	CVE-2024-4320	6 Jun 202419:16	–	osv
OSV	CVE-2024-5443	22 Jun 202417:15	–	osv
Positive Technologies	PT-2024-30366 · Unknown · Parisneo/Lollms-Webui	6 Jun 202400:00	–	ptsecurity
RedhatCVE	CVE-2024-4320	5 Feb 202500:09	–	redhatcve

NVD

Node

lollms lollms_web_uiMatch-

[
  {
    "vendor": "parisneo",
    "product": "parisneo/lollms-webui",
    "versions": [
      {
        "version": "unspecified",
        "status": "affected",
        "versionType": "custom",
        "lessThanOrEqual": "latest"
      }
    ]
  }
]

Source	Link
huntr	www.huntr.com/bounties/d6564f04-0f59-4686-beb2-11659342279b

Parameter	Position	Path	Description	CWE
name	request body	/install_extension	RCE via LFI in /install_extension by crafting the name parameter to load and execute a __init__.py from an arbitrary location.	CWE-22, CWE-29

21 Nov 2024 09:42Current

9.8High risk

Vulners AI Score9.8

CVSS 3.19.8

CVSS 39.8

EPSS0.66234

SSVC