parisneo lollms-webui up to 9.4 lollms_xtts.py run_xtts_api_server xtts_base_url os command injection

Summaryinfo

A vulnerability, which was classified as critical, was found in parisneo lollms-webui up to 9.4. Impacted is the function run_xtts_api_server of the file lollms_xtts.py. The manipulation of the argument xtts_base_url results in os command injection. This vulnerability was named CVE-2024-3126. The attack needs to be approached locally. There is no available exploit. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in parisneo lollms-webui up to 9.4. It has been classified as critical. Affected is the function run_xtts_api_server of the file lollms_xtts.py. The manipulation of the argument xtts_base_url with an unknown input leads to a os command injection vulnerability. CWE is classifying the issue as CWE-78. The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

A command injection vulnerability exists in the 'run_xtts_api_server' function of the parisneo/lollms-webui application, specifically within the 'lollms_xtts.py' script. The vulnerability arises due to the improper neutralization of special elements used in an OS command. The affected function utilizes 'subprocess.Popen' to execute a command constructed with a Python f-string, without adequately sanitizing the 'xtts_base_url' input. This flaw allows attackers to execute arbitrary commands remotely by manipulating the 'xtts_base_url' parameter. The vulnerability affects versions up to and including the latest version before 9.5. Successful exploitation could lead to arbitrary remote code execution (RCE) on the system where the application is deployed.

The advisory is shared for download at huntr.com. This vulnerability is traded as CVE-2024-3126 since 04/01/2024. The exploitability is told to be easy. The attack needs to be approached locally. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1202.

Upgrading to version 9.5 eliminates this vulnerability. Applying the patch 41dbb1b3f2e78ea276e5269544e50514252c0c25 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• parisneo

Name

• lollms-webui

Version

• 9.0
• 9.1
• 9.2
• 9.3
• 9.4

License

• open-source

Website

• Product: https://github.com/parisneo/lollms-webui/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion