CVE-2024-6581: Lollms SVG Upload XSS Vulnerability

CVE-2024-6581 Overview

CVE-2024-6581 is a cross-site scripting (XSS) vulnerability in the Lollms (Lord of Large Language Models) application, version 9.9. The flaw resides in the discussion image upload function, which permits uploading SVG files. The sanitize_svg function performs incomplete filtering, stripping only <script> elements and on* event attributes. Attackers can craft SVG files that contain other XSS vectors not covered by the sanitizer. When an authorized user opens a malicious URL referencing the crafted SVG, the embedded payload executes in the browser context, creating a pathway to remote code execution. The issue is tracked under CWE-79.

Critical Impact

Stored XSS via malicious SVG upload can escalate to remote code execution against authorized Lollms v9.9 users.

Affected Products

• Lollms Lord of Large Language Models version 9.9
• Deployments exposing the discussion image upload endpoint
• Instances relying on the built-in sanitize_svg function for SVG filtering

Discovery Timeline

• 2024-10-29 - CVE-2024-6581 published to NVD
• 2024-11-01 - Last updated in NVD database
• Patch reference - Fix committed in parisneo/lollms commit 328b960
• Bounty disclosure - Reported through the Huntr Bounty program

Technical Details for CVE-2024-6581

Vulnerability Analysis

The vulnerability stems from incomplete sanitization of user-supplied Scalable Vector Graphics (SVG) files. SVG is an XML-based image format that natively supports JavaScript execution through multiple constructs. The Lollms discussion image upload endpoint accepts SVG content and passes it through the sanitize_svg function before storing it for later retrieval.

The sanitize_svg implementation removes <script> tags and attributes matching the on* event handler pattern. This deny-list approach overlooks numerous XSS vectors valid within SVG, including <foreignObject> containing HTML, <use> elements referencing external resources, xlink:href attributes carrying javascript: URIs, CDATA-wrapped scripts, and namespaced event handlers. Attackers craft SVG payloads using these alternative vectors to bypass the filter.

Once stored, the SVG renders inline when an authorized user navigates to a URL that references the file. The payload executes within the application origin, granting the attacker the victim's session privileges. Because Lollms exposes model management and code execution interfaces, an XSS foothold can be pivoted into remote code execution against the host running the language model service.

Root Cause

The root cause is a deny-list sanitizer that does not account for the full XSS surface of the SVG specification. Safe SVG handling requires an allow-list parser that strips all unknown elements, attributes, and URI schemes rather than enumerating known-bad patterns.

Attack Vector

Exploitation requires a low-privileged authenticated account that can invoke the discussion image upload function. The attacker uploads a crafted SVG, then lures a second authorized user into visiting the URL hosting the file. User interaction is required, but the scope changes because script executes against another principal's session. See the vendor commit for the corrected filtering logic.

No verified public exploit code is available. The vulnerability mechanism is described in the Huntr bounty listing.

Detection Methods for CVE-2024-6581

Indicators of Compromise

• SVG files in Lollms upload directories containing <foreignObject>, <use xlink:href="javascript:">, or CDATA-wrapped script blocks
• HTTP POST requests to the discussion image upload endpoint with Content-Type: image/svg+xml
• Unexpected outbound connections from browser sessions of users who viewed shared Lollms discussions
• New or modified administrative accounts following SVG file access events

Detection Strategies

• Inspect stored SVG assets for XML elements and attributes outside an allow-list of static drawing primitives
• Correlate file uploads with subsequent URL access by privileged users to surface social-engineering chains
• Apply YARA or regex scans for javascript: URIs and <foreignObject> tags within image upload directories

Monitoring Recommendations

• Log all discussion image uploads with the uploader identity, source IP, and file hash
• Alert on browser execution of inline scripts originating from image/svg+xml responses served by Lollms
• Track session activity for accounts that recently rendered third-party SVG content for privilege changes

How to Mitigate CVE-2024-6581

Immediate Actions Required

• Upgrade Lollms beyond version 9.9 to a build that incorporates commit 328b960
• Restrict the discussion image upload function to trusted users until patching is complete
• Audit the upload directory and remove any SVG files containing dynamic XML constructs
• Rotate session tokens for accounts that may have rendered untrusted SVG content

Patch Information

The maintainer addressed the issue in the parisneo/lollms repository. Operators should pull the latest version from the upstream repository and redeploy. Verify that the updated sanitize_svg function rejects elements and attributes beyond a safe allow-list.

Workarounds

• Disable SVG uploads entirely and restrict accepted MIME types to raster formats such as PNG and JPEG
• Serve user-uploaded images from a sandboxed origin distinct from the Lollms application domain
• Apply a strict Content Security Policy that blocks inline script execution and javascript: URIs
• Place Lollms behind a web application firewall rule that rejects SVG payloads containing <script>, <foreignObject>, or xlink:href with non-HTTP schemes

# Example nginx configuration to block SVG uploads at the proxy layer
location /discussion/upload {
    if ($http_content_type ~* "image/svg\+xml") {
        return 415;
    }
    proxy_pass http://lollms_backend;
}

# Enforce a restrictive CSP on Lollms responses
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'none'" always;