CVE-2024-4267: Remote Code Execution in parisneo/lollms-webui

Published May 22, 2024

Updated

A remote code execution (RCE) vulnerability exists in the parisneo/lollms-webui, specifically within the 'openfile' module, version 9.5. The vulnerability arises due to improper neutralization of special elements used in a command within the 'openfile' function. An attacker can exploit this vulnerability by crafting a malicious file path that, when processed by the 'openfile' function, executes arbitrary system commands or reads sensitive file content. This issue is present in the code where subprocess.Popen is used unsafely to open files based on user-supplied paths without adequate validation, leading to potential command injection.

Affected Software

2 affected components

parisneo lollms-webui

lollms lollms-webui=9.5

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade parisneo/lollms-webui to a version that resolves this vulnerability.
Fixed in 9.5
Configuration
Modify the 'open_file' code path so that user-supplied file paths are not used in an unsafe subprocess.Popen command context; validate/normalize the path and only open the intended file directly (no command execution based on the path).
parisneo/lollms-webui ('open_file' module) subprocess.Popen invocation = Use safe file handling that does not pass user-supplied paths into a shell/command context (remove command-injection path usage)

Event History

May 22, 2024

CVE Published

via MITRE·07:29 PM

Data Sourced

via MITRE·07:29 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·08:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2024-4267?

CVE-2024-4267 is classified as a critical vulnerability due to its potential for remote code execution.

How do I fix CVE-2024-4267?

To fix CVE-2024-4267, update the parisneo/lollms-webui to the latest version where the vulnerability is patched.

What type of vulnerability is CVE-2024-4267?

CVE-2024-4267 is a remote code execution (RCE) vulnerability.

What component is affected by CVE-2024-4267?

CVE-2024-4267 specifically affects the 'open_file' module within the parisneo/lollms-webui.

Can CVE-2024-4267 be exploited remotely?

Yes, CVE-2024-4267 can be exploited remotely by attackers to execute arbitrary commands.