ghsa-4qp4-9mwx-276r
Vulnerability from github
I have activated the CORS because I had a development ui that uses another port number then I forgot to remove it.
So what I just did is :
- First removed the cors configuration that allows everyone to access it :
before:
python
sio = socketio.AsyncServer(async_mode="asgi", cors_allowed_origins="*", ping_timeout=1200, ping_interval=30) # Enable CORS for every one
after:
```python
cert_file_path = lollms_paths.personal_certificates/"cert.pem"
key_file_path = lollms_paths.personal_certificates/"key.pem"
if os.path.exists(cert_file_path) and os.path.exists(key_file_path):
is_https = True
else:
is_https = False
# Create a Socket.IO server
sio = socketio.AsyncServer(async_mode="asgi", cors_allowed_origins=config.allowed_origins+[f"https://localhost:{config['port']}" if is_https else f"http://localhost:{config['port']}"], ping_timeout=1200, ping_interval=30) # Enable CORS for selected origins
```
-
Second, I have updated lollms to have two modes (a headless mode and a ui mode). And updated the /execute_code to block if the server is headless or is exposed ```python @router.post("/execute_code") async def execute_code(request: Request): """ Executes Python code and returns the output.
:param request: The HTTP request object. :return: A JSON response with the status of the operation. """ if lollmsElfServer.config.headless_server_mode: return {"status":False,"error":"Code execution is blocked when in headless mode for obvious security reasons!"}
if lollmsElfServer.config.host=="0.0.0.0": return {"status":False,"error":"Code execution is blocked when the server is exposed outside for very obvipous reasons!"}
try: data = (await request.json()) code = data["code"] discussion_id = int(data.get("discussion_id","unknown_discussion")) message_id = int(data.get("message_id","unknown_message")) language = data.get("language","python")
if language=="python": ASCIIColors.info("Executing python code:") ASCIIColors.yellow(code) return execute_python(code, discussion_id, message_id) if language=="javascript": ASCIIColors.info("Executing javascript code:") ASCIIColors.yellow(code) return execute_javascript(code, discussion_id, message_id) if language in ["html","html5","svg"]: ASCIIColors.info("Executing javascript code:") ASCIIColors.yellow(code) return execute_html(code, discussion_id, message_id) elif language=="latex": ASCIIColors.info("Executing latex code:") ASCIIColors.yellow(code) return execute_latex(code, discussion_id, message_id) elif language in ["bash","shell","cmd","powershell"]: ASCIIColors.info("Executing shell code:") ASCIIColors.yellow(code) return execute_bash(code, discussion_id, message_id) elif language in ["mermaid"]: ASCIIColors.info("Executing mermaid code:") ASCIIColors.yellow(code) return execute_mermaid(code, discussion_id, message_id) elif language in ["graphviz","dot"]: ASCIIColors.info("Executing graphviz code:") ASCIIColors.yellow(code) return execute_graphviz(code, discussion_id, message_id) return {"status": False, "error": "Unsupported language", "execution_time": 0}except Exception as ex: trace_exception(ex) lollmsElfServer.error(ex) return {"status":False,"error":str(ex)} ```
I also added an optional https mode and looking forward to add a full authentication with cookies and a personal session etc.
All updates will be in V 9.1
Again, thanks alot for your work. I will make it harder next time, but if you find more bugs, just be my guest :)
{
"affected": [],
"aliases": [
"CVE-2024-1522"
],
"database_specific": {
"cwe_ids": [
"CWE-352"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-30T18:15:45Z",
"severity": "HIGH"
},
"details": "I have activated the CORS because I had a development ui that uses another port number then I forgot to remove it.\n\nSo what I just did is :\n- First removed the cors configuration that allows everyone to access it :\nbefore:\n```python\n sio = socketio.AsyncServer(async_mode=\"asgi\", cors_allowed_origins=\"*\", ping_timeout=1200, ping_interval=30) # Enable CORS for every one\n```\nafter:\n```python\n cert_file_path = lollms_paths.personal_certificates/\"cert.pem\"\n key_file_path = lollms_paths.personal_certificates/\"key.pem\"\n if os.path.exists(cert_file_path) and os.path.exists(key_file_path):\n is_https = True\n else:\n is_https = False \n\n # Create a Socket.IO server\n sio = socketio.AsyncServer(async_mode=\"asgi\", cors_allowed_origins=config.allowed_origins+[f\"https://localhost:{config[\u0027port\u0027]}\" if is_https else f\"http://localhost:{config[\u0027port\u0027]}\"], ping_timeout=1200, ping_interval=30) # Enable CORS for selected origins\n```\n\n- Second, I have updated lollms to have two modes (a headless mode and a ui mode).\nAnd updated the /execute_code to block if the server is headless or is exposed\n```python\n@router.post(\"/execute_code\")\nasync def execute_code(request: Request):\n \"\"\"\n Executes Python code and returns the output.\n\n :param request: The HTTP request object.\n :return: A JSON response with the status of the operation.\n \"\"\"\n if lollmsElfServer.config.headless_server_mode:\n return {\"status\":False,\"error\":\"Code execution is blocked when in headless mode for obvious security reasons!\"}\n\n if lollmsElfServer.config.host==\"0.0.0.0\":\n return {\"status\":False,\"error\":\"Code execution is blocked when the server is exposed outside for very obvipous reasons!\"}\n\n try:\n data = (await request.json())\n code = data[\"code\"]\n discussion_id = int(data.get(\"discussion_id\",\"unknown_discussion\"))\n message_id = int(data.get(\"message_id\",\"unknown_message\"))\n language = data.get(\"language\",\"python\")\n \n\n\n if language==\"python\":\n ASCIIColors.info(\"Executing python code:\")\n ASCIIColors.yellow(code)\n return execute_python(code, discussion_id, message_id)\n if language==\"javascript\":\n ASCIIColors.info(\"Executing javascript code:\")\n ASCIIColors.yellow(code)\n return execute_javascript(code, discussion_id, message_id)\n if language in [\"html\",\"html5\",\"svg\"]:\n ASCIIColors.info(\"Executing javascript code:\")\n ASCIIColors.yellow(code)\n return execute_html(code, discussion_id, message_id)\n \n elif language==\"latex\":\n ASCIIColors.info(\"Executing latex code:\")\n ASCIIColors.yellow(code)\n return execute_latex(code, discussion_id, message_id)\n elif language in [\"bash\",\"shell\",\"cmd\",\"powershell\"]:\n ASCIIColors.info(\"Executing shell code:\")\n ASCIIColors.yellow(code)\n return execute_bash(code, discussion_id, message_id)\n elif language in [\"mermaid\"]:\n ASCIIColors.info(\"Executing mermaid code:\")\n ASCIIColors.yellow(code)\n return execute_mermaid(code, discussion_id, message_id)\n elif language in [\"graphviz\",\"dot\"]:\n ASCIIColors.info(\"Executing graphviz code:\")\n ASCIIColors.yellow(code)\n return execute_graphviz(code, discussion_id, message_id)\n return {\"status\": False, \"error\": \"Unsupported language\", \"execution_time\": 0}\n except Exception as ex:\n trace_exception(ex)\n lollmsElfServer.error(ex)\n return {\"status\":False,\"error\":str(ex)}\n```\n\nI also added an optional https mode and looking forward to add a full authentication with cookies and a personal session etc.\n\n\nAll updates will be in V 9.1 \n\n\nAgain, thanks alot for your work. I will make it harder next time, but if you find more bugs, just be my guest :)",
"id": "GHSA-4qp4-9mwx-276r",
"modified": "2024-03-30T18:30:54Z",
"published": "2024-03-30T18:30:54Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1522"
},
{
"type": "WEB",
"url": "https://github.com/parisneo/lollms-webui/commit/0b51063119cfb5e391925d232a4af1de9dc32e2b"
},
{
"type": "WEB",
"url": "https://huntr.com/bounties/687cef92-3432-4d6c-af92-868eccabbb71"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.