CVE-2024-1601
📋 TL;DR
An SQL injection vulnerability in the parisneo/lollms-webui application allows attackers to delete all discussion and message data by sending a crafted HTTP POST request to the /delete_discussion endpoint. This affects all users running vulnerable versions of the lollms-webui software, potentially resulting in complete data loss of conversation histories.
💻 Affected Systems
- parisneo/lollms-webui
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete deletion of all discussion and message data, causing irreversible data loss and service disruption.
Likely Case
Attacker deletes all user discussions and messages, requiring restoration from backups and causing temporary service disruption.
If Mitigated
Attack prevented by proper input validation, with no data loss or minimal impact if detected early.
🎯 Exploit Status
The vulnerability is straightforward to exploit with basic SQL injection techniques and requires no authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Commit f0bc8f2babdfd4770a5adbf3b60ec612e4f1db46 and later
Vendor Advisory: https://github.com/parisneo/lollms-webui/commit/f0bc8f2babdfd4770a5adbf3b60ec612e4f1db46
Restart Required: Yes
Instructions:
1. Update to the latest version of lollms-webui. 2. Apply commit f0bc8f2babdfd4770a5adbf3b60ec612e4f1db46. 3. Restart the application service.
🔧 Temporary Workarounds
WAF Rule Implementation
allImplement web application firewall rules to block SQL injection patterns in POST requests to /delete_discussion endpoint.
Endpoint Restriction
allRestrict access to the /delete_discussion endpoint using network controls or authentication requirements.
🧯 If You Can't Patch
- Implement strict input validation for the 'id' parameter in the delete_discussion() function
- Deploy a WAF with SQL injection protection rules and monitor for attack attempts
🔍 How to Verify
Check if Vulnerable:
Check if your lollms-webui version includes commit f0bc8f2babdfd4770a5adbf3b60ec612e4f1db46. If not, you are vulnerable.Check Version:
git log --oneline | grep f0bc8f2babdfd4770a5adbf3b60ec612e4f1db46Verify Fix Applied:
Verify that parameterized queries or proper input sanitization is implemented in the delete_discussion() function.📡 Detection & Monitoring
Log Indicators:
- Unusual DELETE queries on discussion/message tables
- Multiple rapid requests to /delete_discussion endpoint
- SQL error messages in application logs
Network Indicators:
- POST requests to /delete_discussion with SQL injection patterns
- Unusual traffic patterns to the application endpoint
SIEM Query:
source="web_server_logs" AND uri="/delete_discussion" AND (method="POST") AND (payload CONTAINS "' OR '1'='1" OR payload CONTAINS "--" OR payload CONTAINS ";")🔗 References
- https://github.com/parisneo/lollms-webui/commit/f0bc8f2babdfd4770a5adbf3b60ec612e4f1db46
- https://huntr.com/bounties/652a176e-6bd7-4161-8775-63a34ecc71d5
- https://github.com/parisneo/lollms-webui/commit/f0bc8f2babdfd4770a5adbf3b60ec612e4f1db46
- https://huntr.com/bounties/652a176e-6bd7-4161-8775-63a34ecc71d5
