CVE-2024-12766

Summary

CVE-2024-12766 is a newly identified Server-Side Request Forgery (SSRF) vulnerability affecting the `parisneo/lollms-webui` version V13 (feather). The issue lies in the `POST /api/proxy` REST API which can be exploited by attackers to abuse the victim server's credentials and access unauthorized web resources. Attackers can achieve this by providing a malicious URL in the JSON parameter `{"url":"http://steal.target"}` during API requests. Existing security mechanisms, such as `forbid_remote_access(lollmsElfServer)`, `lollmsElfServer.config.headless_server_mode`, and `check_access(lollmsElfServer, request.client_id)`, do not provide adequate protection against this SSRF vulnerability.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.