CVE-2024-6674
📋 TL;DR
A CORS misconfiguration in lollms-webui allows attackers to steal sensitive information like logs, browser sessions, and settings containing private API keys from other services. This vulnerability can also enable attackers to perform actions on behalf of users, such as deleting projects or sending messages. All users running lollms-webui versions prior to 10 are affected.
💻 Affected Systems
- parisneo/lollms-webui
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of user accounts, theft of all sensitive data including API keys, unauthorized deletion of projects, and impersonation of users across integrated services.
Likely Case
Theft of session data and API keys leading to unauthorized access to integrated services, potential data exfiltration, and limited unauthorized actions within the webui.
If Mitigated
Minimal impact with proper CORS policies, network segmentation, and API key rotation limiting exposure to only publicly accessible data.
🎯 Exploit Status
Exploitation requires attacker to lure victim to malicious site; no authentication needed to exploit CORS misconfiguration.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 10
Vendor Advisory: https://github.com/parisneo/lollms-webui/commit/c1bb1ad19752aa7541675b398495eaf98fd589f1
Restart Required: Yes
Instructions:
1. Update to version 10 or later. 2. Restart the lollms-webui service. 3. Verify CORS headers are properly configured.
🔧 Temporary Workarounds
Manual CORS Configuration
allManually configure proper CORS headers to restrict cross-origin requests
Edit CORS configuration in lollms-webui settings to restrict origins
Reverse Proxy CORS Control
linuxUse reverse proxy (nginx/apache) to enforce proper CORS headers
Add 'add_header Access-Control-Allow-Origin' with specific origins in nginx config
🧯 If You Can't Patch
- Implement strict CORS policies via reverse proxy or application firewall
- Isolate lollms-webui behind VPN or internal network only
🔍 How to Verify
Check if Vulnerable:
Check if Access-Control-Allow-Origin header is set to '*' or overly permissive valuesCheck Version:
Check lollms-webui version in web interface or package managerVerify Fix Applied:
Verify CORS headers restrict origins appropriately and version is 10+📡 Detection & Monitoring
Log Indicators:
- Unusual cross-origin requests
- Multiple failed CORS preflight requests
- Unexpected API key usage
Network Indicators:
- Suspicious cross-origin requests to sensitive endpoints
- Unexpected OPTIONS requests
SIEM Query:
source="webui" AND (uri="/api/*" OR uri="/logs/*") AND referer NOT IN allowed_domains