CVE-2024-4839: CSRF in Servers Configurations in parisneo/lollms-webui
A Cross-Site Request Forgery (CSRF) vulnerability exists in the 'Servers Configurations' function of the parisneo/lollms-webui, versions 9.6 to the latest. The affected functions include Elastic search Service (under construction), XTTS service, Petals service, vLLM service, and Motion Ctrl service, which lack CSRF protection. This vulnerability allows attackers to deceive users into unwittingly installing the XTTS service among other packages by submitting a malicious installation request. Successful exploitation results in attackers tricking users into performing actions without their consent.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Enable CSRF protection for the 'Servers Configurations' function to prevent forged requests that can trick users into installing services (including XTTS) without consent.
parisneo/lollms-webui — Servers Configurations function CSRF protection = enabled - Compensating control
Until CSRF protection is implemented, restrict access to the parisneo/lollms-webui UI and its Servers Configurations actions to trusted users (e.g., via network/ACL/reverse-proxy controls) to reduce the chance of a malicious site successfully triggering actions in a victim’s browser.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-4839?
CVE-2024-4839 has a medium severity rating due to its potential for exploitation in Cross-Site Request Forgery attacks.
How do I fix CVE-2024-4839?
To fix CVE-2024-4839, ensure that all requests to the 'Servers Configurations' function are protected with proper anti-CSRF tokens.
Which versions of the lollms-webui are affected by CVE-2024-4839?
CVE-2024-4839 affects lollms-webui versions 9.6 through the latest version.
What kind of vulnerability is CVE-2024-4839?
CVE-2024-4839 is a Cross-Site Request Forgery (CSRF) vulnerability.
What functions are impacted by CVE-2024-4839?
Affected functions include Elastic search Service, XTTS service, Petals service, vLLM service, among others within the lollms-webui.