CVE-2024-3121

• CVSS 3.3
• CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
• Input Validation and Sanitization

A remote code execution vulnerability exists in the create_conda_env function of the parisneo/lollms repository, version 5.9.0. The vulnerability arises from the use of shell=True in the subprocess.Popen function, which allows an attacker to inject arbitrary commands by manipulating the env_name and python_version parameters. This issue could lead to a serious security breach as demonstrated by the ability to execute the 'whoami' command among potentially other harmful commands.

CVE

CVE-2024-3121

CWE

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSS base score

3.3

Published

2024-06-24

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

def vulnerable_function(user_input):
    """Vulnerable function that processes user input unsafely."""
    # VULNERABLE: Unsafe processing of user input
    result = eval(user_input)  # Never use eval with untrusted input!
    return result

def secure_function(user_input):
    """Secure function that safely processes user input."""
    # SECURE: Validate and sanitize input before processing
    if not isinstance(user_input, str) or len(user_input) > 1000:
        raise ValueError("Invalid input")
    
    # Use safe processing methods
    result = safe_process(user_input)
    return result

@misc{vaitp:cve20243121,
  title        = {{}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2024},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2024-3121},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2024-3121/}}
}