CVE-2024-6674: Data Leak via CORS Misconfiguration in parisneo/lollms-webui

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability Description: - Vulnerability Name: Data leak through CORS misconfiguration in parisneo/lollms-webui - Report Date: July 11, 2024 - Vulnerability Type: Data leakage due to CORS misconfiguration - Impact: May allow theft of sensitive information such as logs, browser sessions, and settings containing private API keys. 2. Exploitation: - Exploitation Steps: 1. Create and save a file named on the attacker’s server. 2. Victim opens a URL containing the attacker’s URL. 3. The code runs and retrieves victim’s data, such as and . 3. Impact: - Information Integrity: Confidentiality is compromised. 4. Reference Link: - https://huntr.com/bounties/7ffeb896-27c8-429d-b241-4f7d6dda0af 5. Vulnerability Status: - Status: Fixed - Fix Date: October 10, 2024 - Fixer: parisneo team 6. Vulnerability Rating: - Severity: High (8.1) - Impact Scope: High - Availability: High 7. Disclosure: - Disclosure Date: October 10, 2024 - Disclosure Reward: $450 - Fix Reward: $112.5 8. Discoverer: - Discoverer: virusday - Discovery Date: July 11, 2024 9. Validator: - Validator: Saifeddine ALOUI - Validation Date: July 11, 2024 10. CVE ID: - CVE Number: CVE-2024-6674 11. Vulnerability Type: - Type: CWE-346: Origin Validation Error 12. Scope: - Scope: n/a 13. Public Disclosure: - Public: Yes 14. Status: - Status: Fixed 15. Disclosure Date: - Date: October 10, 2024 16. Fix Date: - Date: October 10, 2024 17. Fixer: - Fixer: parisneo team 18. Fix Status: - Status: Fixed 19. Fix Reward: - Reward: $112.5 20. Discoverer Reward: - Reward: $450 21. Discoverer Reputation Boost: - Boost: +7 22. CVE ID: - Number: CVE-2024-6674 23. Vulnerability Type: - Type: CWE-346: Origin Validation Error 24. Scope: - Scope: n/a 25. Public Disclosure: - Public: Yes 26. Status: - Status: Fixed 27. Disclosure Date: - Date: October 10, 2024 28. Fix Date: - Date: October 10, 2024 29. Fixer: - Fixer: parisneo team 30. Fix Status: - Status: Fixed 31. Fix Reward: - Reward: $112.5 32. Discoverer Reward: - Reward: $450 33. Discoverer Reputation Boost: - Boost: +7 34. CVE ID: - Number: CVE-2024-6674 35. Vulnerability Type: - Type: CWE-346: Origin Validation Error 36. Scope: - Scope: n/a 37. Public Disclosure: - Public: Yes 38. Status: - Status: Fixed 39. Disclosure Date: - Date: October 10, 2024 40. Fix Date: - Date: October 10, 2024 41. Fixer: - Fixer: parisneo team 42. Fix Status: - Status: Fixed 43. Fix Reward: - Reward: $112.5 44. Discoverer Reward: - Reward: $450 45. Discoverer Reputation Boost: - Boost: +7 46. CVE ID: - Number: CVE-2024-6674 47. Vulnerability Type: - Type: CWE-346: Origin Validation Error 48. Scope: - Scope: n/a 49. Public Disclosure: - Public: Yes 50. Status: - Status: Fixed 51. Disclosure Date: - Date: October 10, 2024 52. Fix Date: - Date: October 10, 2024 53. Fixer: - Fixer: parisneo team 54. Fix Status: - Status: Fixed 55. Fix Reward: - Reward: $112.5 56. Discoverer Reward: - Reward: $450 57. Discoverer Reputation Boost: - Boost: +7 58. CVE ID: - Number: CVE-2024-6674 59. Vulnerability Type: - Type: CWE-346: Origin Validation Error 60. Scope: - Scope: n/a 61. Public Disclosure: - Public: Yes 62. Status: - Status: Fixed 63. Disclosure Date: - Date: October 10, 2024 64. Fix Date: - Date: October 10, 2024 65. Fixer: - Fixer: parisneo team 66. Fix Status: - Status: Fixed 67. Fix Reward: - Reward: $112.5 68. Discoverer Reward: - Reward: $450 69. Discoverer Reputation Boost: - Boost: +7 70. CVE ID: - Number: CVE-2024-6674 71. Vulnerability Type: - Type: CWE-346: Origin Validation Error 72. Scope: - Scope: n/a 73. Public Disclosure: - Public: Yes 74. Status: - Status: Fixed 75. Disclosure Date: - Date: October 10, 2024 76. Fix Date: - Date: October 10, 2024 77. Fixer: - Fixer: parisneo team 78. Fix Status: - Status: Fixed 79. Fix Reward: - Reward: $112.5 80. Discoverer Reward: - Reward: $450 81. Discoverer Reputation Boost: - Boost: +7 82. CVE ID: - Number: CVE-2024-6674 83. Vulnerability Type: - Type: CWE-346: Origin Validation Error 84. Scope: - Scope: n/a 85. Public Disclosure: - Public: Yes 86. Status: - Status: Fixed 87. Disclosure Date: - Date: October 10, 2024 88. Fix Date: - Date: October 10, 2024 89. Fixer: - Fixer: parisneo team 90. Fix Status: - Status: Fixed 91. Fix Reward: - Reward: $112.5 92. Discoverer Reward: - Reward: $450 93. Discoverer Reputation Boost: - Boost: +7 94. CVE ID: - Number: CVE-2024-6674 95. Vulnerability Type: - Type: CWE-346: Origin Validation Error 96. Scope: - Scope: n/a 97. Public Disclosure: - Public: Yes 98. Status: - Status: Fixed 99. Disclosure Date: - Date: October 10, 2024 100. Fix Date: - Date: October 10, 2024 101. Fixer: - Fixer: parisneo team 102. Fix Status: - Status: Fixed 103. Fix Reward: - Reward: $112.5 104. Discoverer Reward: - Reward: $450 105. Discoverer Reputation Boost: - Boost: +7 106. CVE ID: - Number: CVE-2024-6674 107. Vulnerability Type: - Type: CWE-346: Origin Validation Error 108.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2024-6674: Data Leak via CORS Misconfiguration in parisneo/lollms-webui