A vulnerability in the parisneo/lollms-webui version 9.3 allows attackers to bypass intended access restrictions and execute arbitrary code. The issue arises from the application's handling of the `/execute_code` endpoint, which is intended to be blocked from external access by default. However, attackers can exploit the `/update_setting` endpoint, which lacks proper access control, to modify the `host` configuration at runtime. By changing the `host` setting to an attacker-controlled value, the restriction on the `/execute_code` endpoint can be bypassed, leading to remote code execution. This vulnerability is due to improper neutralization of special elements used in an OS command (`Improper Neutralization of Special Elements used in an OS Command`).
The application by default blocks external access to the `/execute_code` endpoint, which is used for code execution. However, the `/update_setting` endpoint lacks proper access controls, allowing an unauthorized attacker to modify the application's configuration at runtime. The attacker can change the `host` parameter to a value they control, bypassing the `/execute_code` endpoint block. As a result, arbitrary system commands can be executed through command injection (CWE-78) resulting from improper neutralization of special characters in operating system commands.
An attacker can remotely execute arbitrary code on the server hosting the application without any authentication, resulting in a complete breach of system confidentiality, integrity, and availability.
Apply patches available from the vendor according to the references. It is also recommended to restrict network access to the lollms-webui instance only to trusted hosts and to monitor calls to the `/update_setting` and `/execute_code` endpoints.
parisneo/lollms-webui version 9.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HLollms Web Ui
APPLollms9.3
Related vulnerabilities
SSRF i brak uwierzytelnienia w lollms-webui — dostęp do wewnętrznych zasobów
Path traversal w API install/uninstall lollms-webui V12 (Strawberry)
Path Traversal w lollms-webui umożliwia usunięcie dowolnego pliku
Path Traversal i DoS w endpoint /select_database aplikacji lollms-webui
Path Traversal prowadzący do RCE w parisneo/lollms-webui