CVE-2024-1646
📋 TL;DR
CVE-2024-1646 is an authentication bypass vulnerability in parisneo/lollms-webui that allows unauthorized access to sensitive endpoints. Attackers can exploit inadequate host parameter checking to execute administrative functions without authentication. This affects all deployments of lollms-webui with the vulnerable code.
💻 Affected Systems
- parisneo/lollms-webui
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through arbitrary code execution if vulnerable endpoints allow command injection, plus denial of service through forced restarts and unauthorized control over recording functions.
Likely Case
Denial of service through forced application restarts, unauthorized disabling/overriding of recordings, and potential configuration changes if other vulnerable endpoints exist.
If Mitigated
No impact if proper authentication controls are implemented and the vulnerable code is patched or workarounds applied.
🎯 Exploit Status
Exploitation requires sending requests to vulnerable endpoints with manipulated host parameters. Public details available in bounty reports.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Commit 02e829b5653a1aa5dbbe9413ec84f96caa1274e8
Vendor Advisory: https://github.com/parisneo/lollms-webui/commit/02e829b5653a1aa5dbbe9413ec84f96caa1274e8
Restart Required: Yes
Instructions:
1. Update to latest lollms-webui version. 2. Apply commit 02e829b5653a1aa5dbbe9413ec84f96caa1274e8. 3. Restart the application. 4. Verify authentication is properly enforced on all endpoints.
🔧 Temporary Workarounds
Network Access Control
linuxRestrict network access to lollms-webui using firewall rules
iptables -A INPUT -p tcp --dport [lollms-port] -s [trusted-ips] -j ACCEPT
iptables -A INPUT -p tcp --dport [lollms-port] -j DROP
Reverse Proxy Authentication
allPlace lollms-webui behind a reverse proxy with proper authentication
🧯 If You Can't Patch
- Implement strict network segmentation and firewall rules to limit access to trusted IPs only
- Disable or block access to vulnerable endpoints (/restart_program, /update_software, /check_update, /start_recording, /stop_recording) at network level
🔍 How to Verify
Check if Vulnerable:
Test if unauthenticated requests to vulnerable endpoints succeed when host parameter is manipulated. Check if current version predates commit 02e829b5653a1aa5dbbe9413ec84f96caa1274e8.Check Version:
Check git commit hash or version in lollms-webui interface/source codeVerify Fix Applied:
Verify authentication is required for all sensitive endpoints. Test that host parameter manipulation no longer bypasses authentication.📡 Detection & Monitoring
Log Indicators:
- Unauthorized access attempts to /restart_program, /update_software, /check_update, /start_recording, /stop_recording endpoints
- Multiple restart requests from single IP
- Recording control requests without authentication logs
Network Indicators:
- HTTP requests to sensitive endpoints without authentication headers
- Requests with manipulated Host headers to lollms-webui
SIEM Query:
source="web_server_logs" AND (uri_path="/restart_program" OR uri_path="/update_software" OR uri_path="/check_update" OR uri_path="/start_recording" OR uri_path="/stop_recording") AND NOT (user!="" OR auth_token!="")🔗 References
- https://github.com/parisneo/lollms-webui/commit/02e829b5653a1aa5dbbe9413ec84f96caa1274e8
- https://huntr.com/bounties/2f769c46-aa85-4ab8-8b08-fe791313b7ba
- https://github.com/parisneo/lollms-webui/commit/02e829b5653a1aa5dbbe9413ec84f96caa1274e8
- https://huntr.com/bounties/2f769c46-aa85-4ab8-8b08-fe791313b7ba
