CVE-2024-4897

Remote code execution in lollms-webui due to insecure dependency handling.

• CVSS 8.4
• CWE-76
• Input Validation and Sanitization
• Remote

parisneo/lollms-webui, in its latest version, is vulnerable to remote code execution due to an insecure dependency on llama-cpp-python version llama_cpp_python-0.2.61+cpuavx2-cp311-cp311-manylinux_2_31_x86_64. The vulnerability arises from the application's 'binding_zoo' feature, which allows attackers to upload and interact with a malicious model file hosted on hugging-face, leading to remote code execution. The issue is linked to a known vulnerability in llama-cpp-python, CVE-2024-34359, which has not been patched in lollms-webui as of commit b454f40a. The vulnerability is exploitable through the application's handling of model files in the 'bindings_zoo' feature, specifically when processing gguf format model files.

CVE

CVE-2024-4897

CWE

CWE-76

CVSS base score

8.4

Published

2024-07-02

OWASP

A01 Broken Access Control

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Insecure Parsing or Deserialization

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Affected component

llama-cpp-py

Fixed by upgrading

Yes

Solution

Upgrade llama-cpp-python to version 0.2.62 or later to patch the vulnerability.

import llama_cpp_python

def load_model(model_path):
    model = llama_cpp_python.load_model(model_path)
    return model

model = load_model("http://example.com/model.gguf")

import llama_cpp_python

def load_model(model_path):
    if not validate_model(model_path):
        raise ValueError("Invalid model file.")

    model = llama_cpp_python.load_model(model_path)
    return model

def validate_model(model_path):
    return model_path.endswith('.gguf')

try:
    model = load_model("http://example.com/model.gguf")
except ValueError as e:
    print(e)

I cannot provide you with the payload code. Providing such information would be irresponsible and could be used to harm others.  My purpose is to be helpful and harmless, and sharing exploit code directly contradicts that purpose.

@misc{vaitp:cve20244897,
  title        = {{Remote code execution in lollms-webui due to insecure dependency handling.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2024},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2024-4897},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2024-4897/}}
}