CVE-2024-1569: Uncontrolled Resource Consumption in parisneo/lollms-webui
parisneo/lollms-webui is vulnerable to a denial of service (DoS) attack due to uncontrolled resource consumption. Attackers can exploit the /opencodeinvscode and similar endpoints without authentication by sending repeated HTTP POST requests, leading to the opening of Visual Studio Code or the default folder opener (e.g., File Explorer, xdg-open) multiple times. This can render the host machine unusable by exhausting system resources. The vulnerability is present in the latest version of the software.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-1569?
CVE-2024-1569 is classified as a moderate severity vulnerability due to its potential for denial of service.
How do I fix CVE-2024-1569?
To fix CVE-2024-1569, ensure endpoints like `/open_code_in_vs_code` are protected by authentication mechanisms and implement rate limiting.
What type of attack does CVE-2024-1569 allow?
CVE-2024-1569 allows for denial of service attacks due to uncontrolled resource consumption from repeated HTTP POST requests.
Which software is affected by CVE-2024-1569?
CVE-2024-1569 affects the parisneo/lollms-webui application.
Is authentication required to exploit CVE-2024-1569?
No, CVE-2024-1569 can be exploited without authentication, allowing attackers to send requests freely.