Lucene search

@huntr_aiCVELIST:CVE-2024-5181

HistoryJun 26, 2024 - 2:53 a.m.

CVE-2024-5181 Command Injection in mudler/localai

2024-06-2602:53:58

CWE-78

@huntr_ai

www.cve.org

cve-2024-5181

command injection

mudler/localai

configuration file

arbitrary code execution

os command

full system control

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.0004 Low

EPSS

Percentile

9.8%

JSON

A command injection vulnerability exists in the mudler/localai version 2.14.0. The vulnerability arises from the application’s handling of the backend parameter in the configuration file, which is used in the name of the initialized process. An attacker can exploit this vulnerability by manipulating the path of the vulnerable binary file specified in the backend parameter, allowing the execution of arbitrary code on the system. This issue is due to improper neutralization of special elements used in an OS command, leading to potential full control over the affected system.

CNA Affected

[
  {
    "vendor": "mudler",
    "product": "mudler/localai",
    "versions": [
      {
        "version": "unspecified",
        "lessThan": "2.16.0",
        "status": "affected",
        "versionType": "custom"
      }
    ]
  }
]

References

github.com/mudler/localai/commit/1a3dedece06cab1acc3332055d285ac540a47f0e

huntr.com/bounties/c6e3cb58-6fa4-4207-bb92-ae7644174661

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.0004 Low

EPSS

Percentile

9.8%

JSON

Related for CVELIST:CVE-2024-5181