CVE-2024-8736

Summary

CVE-2024-8736 is a Denial of Service (DoS) vulnerability affecting multiple file upload endpoints of parisneo/lollms-webui version V12 (Strawberry). The vulnerability can be exploited remotely through Cross-Site Request Forgery (CSRF). Despite CSRF protection, the application fails to adequately validate multipart boundaries, leading to resource exhaustion. An attacker can append additional characters to the multipart boundary, causing the server to parse each byte, ultimately resulting in service unavailability. The affected endpoints are `/upload_avatar`, `/upload_app`, and `/upload_logo`.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.