CVE-2024-1522: Lollms Web UI CSRF Vulnerability

CVE-2024-1522 Overview

CVE-2024-1522 is a Cross-Site Request Forgery (CSRF) vulnerability in the parisneo/lollms-webui project. The flaw resides in the /execute_code API endpoint, which fails to validate the origin of incoming requests. Remote attackers can craft a malicious webpage that submits a form to a victim's local lollms-webui instance, triggering execution of arbitrary operating system commands. The attack requires only that a logged-in user visit the attacker-controlled page. Successful exploitation grants the attacker full control of the victim's system without direct network access to the vulnerable application. The vulnerability is tracked under CWE-352.

Critical Impact
A single visit to a malicious webpage allows attackers to execute arbitrary OS commands on any system running a vulnerable lollms-webui instance, resulting in complete system compromise.

Affected Products

parisneo lollms-webui (all versions prior to the patched commit 0b51063)
Deployments exposing the /execute_code API endpoint
Local instances of lollms-webui accessible from the user's browser

Discovery Timeline

2024-03-30 - CVE-2024-1522 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2024-1522

Vulnerability Analysis

The lollms-webui project exposes a REST endpoint at /execute_code intended for running user-submitted code through the local interface. The endpoint accepts POST requests but does not implement anti-CSRF tokens, verify the Origin or Referer headers, or require a re-authentication step. Because the application typically runs on localhost, browser same-origin policy does not prevent cross-origin form submissions from reaching it. An attacker who lures a user with lollms-webui running locally to visit a malicious page can silently issue a POST to http://127.0.0.1:<port>/execute_code and execute arbitrary shell commands under the privileges of the lollms-webui process.

Root Cause

The root cause is missing CSRF protection on a state-changing, code-executing endpoint. The endpoint accepts simple form-encoded POST bodies, which browsers permit cross-origin without preflight. Combined with the endpoint's ability to invoke OS commands, this transforms a browsing action into a full remote code execution primitive.

Attack Vector

Exploitation proceeds in three steps. First, the attacker hosts a webpage containing a hidden auto-submitting HTML form or JavaScript fetch() call targeting /execute_code on localhost. Second, the victim, who has lollms-webui running, visits the page. Third, the browser submits the request with the victim's context, causing the server to execute the attacker's command payload. No credentials are required because lollms-webui does not enforce authentication on this endpoint by default.

python

 from socketio import ASGIApp
 import webbrowser
 import threading
-
+import os
 
 app = FastAPI()
 
-# Create a Socket.IO server
-sio = socketio.AsyncServer(async_mode="asgi", cors_allowed_origins="*", ping_timeout=1200, ping_interval=30)  # Enable CORS for all origins
-
-
-
-@sio.event
-async def disconnect(sid):
-    ASCIIColors.yellow(f"Disconnected: {sid}")
-
-@sio.event
-async def message(sid, data):
-    ASCIIColors.yellow(f"Message from {sid}: {data}")
-    await sio.send(sid, "Message received!")

Source: parisneo/lollms-webui commit 0b51063. The patch removes the permissive cors_allowed_origins="*" configuration that allowed cross-origin requests to reach sensitive endpoints.

Detection Methods for CVE-2024-1522

Indicators of Compromise

Unexpected POST requests to /execute_code originating from external Referer or Origin headers in application logs
Child processes spawned by the lollms-webui Python process executing shell utilities such as sh, bash, cmd.exe, or powershell.exe
Outbound network connections from the lollms-webui process to unknown hosts shortly after user web browsing activity
Creation of new files, scheduled tasks, or persistence artifacts by the lollms-webui process user context

Detection Strategies

Inspect lollms-webui HTTP access logs for requests to /execute_code where the Referer header does not match the local application origin
Monitor endpoint telemetry for the lollms-webui process launching command interpreters or reconnaissance binaries
Correlate browser process activity with immediate spawning of child shells from local Python-based web servers

Monitoring Recommendations

Enable request logging on the lollms-webui instance and forward logs to a centralized SIEM for review
Alert on any process tree where a browser is followed by localhost HTTP traffic and subsequent shell execution
Baseline normal /execute_code usage patterns and flag deviations in request source, frequency, or payload structure

How to Mitigate CVE-2024-1522

Immediate Actions Required

Update lollms-webui to the version containing commit 0b51063119cfb5e391925d232a4af1de9dc32e2b or later
Stop running lollms-webui with unrestricted CORS configuration until the patch is applied
Avoid browsing untrusted websites while lollms-webui is running locally
Bind the lollms-webui service to 127.0.0.1 and restrict access with a host-based firewall rule

Patch Information

The vendor addressed the vulnerability in commit 0b51063, which tightens the Socket.IO CORS policy that previously permitted requests from any origin. Additional details are available in the Huntr bounty report. Pull the latest source from the upstream repository and restart the service to apply the fix.

Workarounds

Terminate the lollms-webui process when not in active use to eliminate the attack surface
Deploy a reverse proxy in front of lollms-webui that enforces Origin header validation and rejects cross-site POST requests
Run lollms-webui in an isolated virtual machine or container so that command execution does not affect the host system
Use a dedicated browser profile with no other tabs open while interacting with lollms-webui

bash

# Configuration example: restrict lollms-webui to localhost and block external Origins via nginx
server {
    listen 127.0.0.1:9600;
    location /execute_code {
        if ($http_origin !~ "^http://127\.0\.0\.1(:[0-9]+)?$") {
            return 403;
        }
        proxy_pass http://127.0.0.1:9601;
    }
}