CVE-2024-1522
Assigner: @huntr_ai
Published: 2024-03-30T18:02:59.260Z
State: PUBLISHED
title: Cross-Site Request Forgery (CSRF) Leading to Remote Code Execution in parisneo/lollms-webui
descriptions: value: A Cross-Site Request Forgery (CSRF) vulnerability in the parisneo/lollms-webui project allows remote attackers to execute arbitrary code on a victim's system. The vulnerability stems from the `/execute_code` API endpoint, which does not properly validate requests, enabling an attacker to craft a malicious webpage that, when visited by a victim, submits a form to the victim's local lollms-webui instance to execute arbitrary OS commands. This issue allows attackers to take full control of the victim's system without requiring direct network access to the vulnerable application.
affected: vendor: parisneo
product: parisneo/lollms-webui
versions: version: unspecified
lessThan: 9.2
status: affected
versionType: custom
metrics: cvssV3_0: version: 3.0
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
baseScore: 8.8
baseSeverity: HIGH
problemTypes: descriptions: type: CWE
description: CWE-352 Cross-Site Request Forgery (CSRF)
cweId: CWE-352
source: advisory: 687cef92-3432-4d6c-af92-868eccabbb71
discovery: EXTERNAL