GHSA-4QP4-9MWX-276R

Vulnerability from github – Published: 2024-03-30 18:30 – Updated: 2024-03-30 18:30
VLAI?
Details

I have activated the CORS because I had a development ui that uses another port number then I forgot to remove it.

So what I just did is : - First removed the cors configuration that allows everyone to access it : before:

    sio = socketio.AsyncServer(async_mode="asgi", cors_allowed_origins="*", ping_timeout=1200, ping_interval=30)  # Enable CORS for every one

after:

    cert_file_path = lollms_paths.personal_certificates/"cert.pem"
    key_file_path = lollms_paths.personal_certificates/"key.pem"
    if os.path.exists(cert_file_path) and os.path.exists(key_file_path):
        is_https = True
    else:
        is_https = False        

    # Create a Socket.IO server
    sio = socketio.AsyncServer(async_mode="asgi", cors_allowed_origins=config.allowed_origins+[f"https://localhost:{config['port']}" if is_https else f"http://localhost:{config['port']}"], ping_timeout=1200, ping_interval=30)  # Enable CORS for selected origins
  • Second, I have updated lollms to have two modes (a headless mode and a ui mode). And updated the /execute_code to block if the server is headless or is exposed
@router.post("/execute_code")
async def execute_code(request: Request):
    """
    Executes Python code and returns the output.

    :param request: The HTTP request object.
    :return: A JSON response with the status of the operation.
    """
    if lollmsElfServer.config.headless_server_mode:
        return {"status":False,"error":"Code execution is blocked when in headless mode for obvious security reasons!"}

    if lollmsElfServer.config.host=="0.0.0.0":
        return {"status":False,"error":"Code execution is blocked when the server is exposed outside for very obvipous reasons!"}

    try:
        data = (await request.json())
        code = data["code"]
        discussion_id = int(data.get("discussion_id","unknown_discussion"))
        message_id = int(data.get("message_id","unknown_message"))
        language = data.get("language","python")



        if language=="python":
            ASCIIColors.info("Executing python code:")
            ASCIIColors.yellow(code)
            return execute_python(code, discussion_id, message_id)
        if language=="javascript":
            ASCIIColors.info("Executing javascript code:")
            ASCIIColors.yellow(code)
            return execute_javascript(code, discussion_id, message_id)
        if language in ["html","html5","svg"]:
            ASCIIColors.info("Executing javascript code:")
            ASCIIColors.yellow(code)
            return execute_html(code, discussion_id, message_id)

        elif language=="latex":
            ASCIIColors.info("Executing latex code:")
            ASCIIColors.yellow(code)
            return execute_latex(code, discussion_id, message_id)
        elif language in ["bash","shell","cmd","powershell"]:
            ASCIIColors.info("Executing shell code:")
            ASCIIColors.yellow(code)
            return execute_bash(code, discussion_id, message_id)
        elif language in ["mermaid"]:
            ASCIIColors.info("Executing mermaid code:")
            ASCIIColors.yellow(code)
            return execute_mermaid(code, discussion_id, message_id)
        elif language in ["graphviz","dot"]:
            ASCIIColors.info("Executing graphviz code:")
            ASCIIColors.yellow(code)
            return execute_graphviz(code, discussion_id, message_id)
        return {"status": False, "error": "Unsupported language", "execution_time": 0}
    except Exception as ex:
        trace_exception(ex)
        lollmsElfServer.error(ex)
        return {"status":False,"error":str(ex)}

I also added an optional https mode and looking forward to add a full authentication with cookies and a personal session etc.

All updates will be in V 9.1

Again, thanks alot for your work. I will make it harder next time, but if you find more bugs, just be my guest :)

Severity ?
8.8 (High)
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-1522"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-03-30T18:15:45Z",
    "severity": "HIGH"
  },
  "details": "I have activated the CORS because I had a development ui that uses another port number then I forgot to remove it.\n\nSo what I just did is :\n- First removed the cors configuration that allows everyone to access it :\nbefore:\n```python\n    sio = socketio.AsyncServer(async_mode=\"asgi\", cors_allowed_origins=\"*\", ping_timeout=1200, ping_interval=30)  # Enable CORS for every one\n```\nafter:\n```python\n    cert_file_path = lollms_paths.personal_certificates/\"cert.pem\"\n    key_file_path = lollms_paths.personal_certificates/\"key.pem\"\n    if os.path.exists(cert_file_path) and os.path.exists(key_file_path):\n        is_https = True\n    else:\n        is_https = False        \n\n    # Create a Socket.IO server\n    sio = socketio.AsyncServer(async_mode=\"asgi\", cors_allowed_origins=config.allowed_origins+[f\"https://localhost:{config[\u0027port\u0027]}\" if is_https else f\"http://localhost:{config[\u0027port\u0027]}\"], ping_timeout=1200, ping_interval=30)  # Enable CORS for selected origins\n```\n\n- Second, I have updated lollms to have two modes (a headless mode and a ui mode).\nAnd updated the /execute_code to block if the server is headless or is exposed\n```python\n@router.post(\"/execute_code\")\nasync def execute_code(request: Request):\n    \"\"\"\n    Executes Python code and returns the output.\n\n    :param request: The HTTP request object.\n    :return: A JSON response with the status of the operation.\n    \"\"\"\n    if lollmsElfServer.config.headless_server_mode:\n        return {\"status\":False,\"error\":\"Code execution is blocked when in headless mode for obvious security reasons!\"}\n\n    if lollmsElfServer.config.host==\"0.0.0.0\":\n        return {\"status\":False,\"error\":\"Code execution is blocked when the server is exposed outside for very obvipous reasons!\"}\n\n    try:\n        data = (await request.json())\n        code = data[\"code\"]\n        discussion_id = int(data.get(\"discussion_id\",\"unknown_discussion\"))\n        message_id = int(data.get(\"message_id\",\"unknown_message\"))\n        language = data.get(\"language\",\"python\")\n        \n\n\n        if language==\"python\":\n            ASCIIColors.info(\"Executing python code:\")\n            ASCIIColors.yellow(code)\n            return execute_python(code, discussion_id, message_id)\n        if language==\"javascript\":\n            ASCIIColors.info(\"Executing javascript code:\")\n            ASCIIColors.yellow(code)\n            return execute_javascript(code, discussion_id, message_id)\n        if language in [\"html\",\"html5\",\"svg\"]:\n            ASCIIColors.info(\"Executing javascript code:\")\n            ASCIIColors.yellow(code)\n            return execute_html(code, discussion_id, message_id)\n        \n        elif language==\"latex\":\n            ASCIIColors.info(\"Executing latex code:\")\n            ASCIIColors.yellow(code)\n            return execute_latex(code, discussion_id, message_id)\n        elif language in [\"bash\",\"shell\",\"cmd\",\"powershell\"]:\n            ASCIIColors.info(\"Executing shell code:\")\n            ASCIIColors.yellow(code)\n            return execute_bash(code, discussion_id, message_id)\n        elif language in [\"mermaid\"]:\n            ASCIIColors.info(\"Executing mermaid code:\")\n            ASCIIColors.yellow(code)\n            return execute_mermaid(code, discussion_id, message_id)\n        elif language in [\"graphviz\",\"dot\"]:\n            ASCIIColors.info(\"Executing graphviz code:\")\n            ASCIIColors.yellow(code)\n            return execute_graphviz(code, discussion_id, message_id)\n        return {\"status\": False, \"error\": \"Unsupported language\", \"execution_time\": 0}\n    except Exception as ex:\n        trace_exception(ex)\n        lollmsElfServer.error(ex)\n        return {\"status\":False,\"error\":str(ex)}\n```\n\nI also added an optional https mode and looking forward to add a full authentication with cookies and a personal session etc.\n\n\nAll updates will be in V 9.1 \n\n\nAgain, thanks alot for your work. I will make it harder next time, but if you find more bugs, just be my guest :)",
  "id": "GHSA-4qp4-9mwx-276r",
  "modified": "2024-03-30T18:30:54Z",
  "published": "2024-03-30T18:30:54Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1522"
    },
    {
      "type": "WEB",
      "url": "https://github.com/parisneo/lollms-webui/commit/0b51063119cfb5e391925d232a4af1de9dc32e2b"
    },
    {
      "type": "WEB",
      "url": "https://huntr.com/bounties/687cef92-3432-4d6c-af92-868eccabbb71"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.