CVE-2024-4499

A Cross-Site Request Forgery (CSRF) vulnerability exists in the XTTS server of parisneo/lollms version 9.6 due to a lax CORS policy. The vulnerability allows attackers to perform unauthorized actions by tricking a user into visiting a malicious webpage, which can then trigger arbitrary LoLLMS-XTTS API requests. This issue can lead to the reading and writing of audio files and, when combined with other vulnerabilities, could allow for the reading of arbitrary files on the system and writing files outside the permitted audio file location.

CVSS v3 6.3 MEDIUM

6.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://huntr.com/bounties/336cd0eb-eb47-450d-9b2c-9332f69af65a	Exploit Third Party Advisory
https://huntr.com/bounties/336cd0eb-eb47-450d-9b2c-9332f69af65a	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:lollms:lollms:9.6:*:*:*:*:*:*:*

History

No history.

Information

Published : 2024-06-24 03:15

Updated : 2024-11-21 09:42

NVD link : CVE-2024-4499

Mitre link : CVE-2024-4499

CVE.ORG link : CVE-2024-4499

JSON object : View

Products Affected

lollms

lollms

CWE

CWE-352

Cross-Site Request Forgery (CSRF)

{"id": "CVE-2024-4499", "cveTags": [], "metrics": {"cvssMetricV30": [{"type": "Secondary", "source": "security@huntr.dev", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.7, "exploitabilityScore": 2.8}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 2.8}]}, "published": "2024-06-24T03:15:09.797", "references": [{"url": "https://huntr.com/bounties/336cd0eb-eb47-450d-9b2c-9332f69af65a", "tags": ["Exploit", "Third Party Advisory"], "source": "security@huntr.dev"}, {"url": "https://huntr.com/bounties/336cd0eb-eb47-450d-9b2c-9332f69af65a", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security@huntr.dev", "description": [{"lang": "en", "value": "CWE-352"}]}], "descriptions": [{"lang": "en", "value": "A Cross-Site Request Forgery (CSRF) vulnerability exists in the XTTS server of parisneo/lollms version 9.6 due to a lax CORS policy. The vulnerability allows attackers to perform unauthorized actions by tricking a user into visiting a malicious webpage, which can then trigger arbitrary LoLLMS-XTTS API requests. This issue can lead to the reading and writing of audio files and, when combined with other vulnerabilities, could allow for the reading of arbitrary files on the system and writing files outside the permitted audio file location."}, {"lang": "es", "value": "Existe una vulnerabilidad de Cross-Site Request Forgery (CSRF) en el servidor XTTS de parisneo/lollms versi\u00f3n 9.6 debido a una pol\u00edtica CORS laxa. La vulnerabilidad permite a los atacantes realizar acciones no autorizadas enga\u00f1ando a un usuario para que visite una p\u00e1gina web maliciosa, lo que luego puede desencadenar solicitudes arbitrarias de la API LoLLMS-XTTS. Este problema puede provocar la lectura y escritura de archivos de audio y, cuando se combina con otras vulnerabilidades, podr\u00eda permitir la lectura de archivos arbitrarios en el sistema y la escritura de archivos fuera de la ubicaci\u00f3n permitida para archivos de audio."}], "lastModified": "2024-11-21T09:42:57.480", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:lollms:lollms:9.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "443FBFD4-2B8D-4806-91EB-75D1017AD940"}], "operator": "OR"}]}], "sourceIdentifier": "security@huntr.dev"}