CVE-2024-1602: Stored XSS leading to RCE in parisneo/lollms-webui
parisneo/lollms-webui is vulnerable to stored Cross-Site Scripting (XSS) that leads to Remote Code Execution (RCE). The vulnerability arises due to inadequate sanitization and validation of model output data, allowing an attacker to inject malicious JavaScript code. This code can be executed within the user's browser context, enabling the attacker to send a request to the /executecode endpoint and establish a reverse shell to the attacker's host. The issue affects various components of the application, including the handling of user input and model output.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-1602?
CVE-2024-1602 is considered a high severity vulnerability due to its potential to lead to Remote Code Execution.
How do I fix CVE-2024-1602?
To fix CVE-2024-1602, ensure proper sanitization and validation of model output data to prevent XSS attacks.
What type of vulnerability is CVE-2024-1602?
CVE-2024-1602 is a stored Cross-Site Scripting (XSS) vulnerability.
Who is affected by CVE-2024-1602?
CVE-2024-1602 affects users of the parisneo/lollms-webui software.
What can an attacker do with CVE-2024-1602?
An attacker exploiting CVE-2024-1602 can inject malicious JavaScript code, potentially leading to unauthorized actions on the server.