CVE-2024-2356 Details

A Local File Inclusion (LFI) vulnerability has been identified in the Parisneo Lollms-Webui application, specifically within the '/reinstall_extension' endpoint. The vulnerability arises in the 'name' parameter of the '@router.post("/reinstall_extension")' route, allowing attackers to inject malicious payloads. This exploitation leads to the server executing arbitrary Python files from the upload directory associated with discussions. The issue is caused by the direct concatenation of 'data.name' with 'lollmsElfServer.lollms_paths.extensions_zoo_path', which is then used as an argument for 'ExtensionBuilder().build_extension()'. The server's handling of the '__init__.py' file in arbitrary locations, facilitated by 'importlib.machinery.SourceFileLoader', enables the execution of arbitrary code, such as command execution or creating a reverse-shell connection. This vulnerability affects the latest version of Parisneo Lollms-Webui and can lead to Remote Code Execution (RCE) when the application is exposed to an external endpoint or the UI, especially when bound to '0.0.0.0' or in 'headless mode'. No user interaction is required for exploitation.

The vulnerability has been fixed in version 9.5 of the Parisneo Lollms-Webui application. Users should update to this version to address the issue.