CVE-2024-12766: SSRF in lollms-webui

The SSRF vulnerability in lollms-webui allows an attacker to craft malicious requests through the /api/proxy endpoint. By manipulating the url parameter within a POST request (e.g., {"url":"http://steal.target"}), an attacker can force the server to make requests to arbitrary internal or external URLs. This can lead to the exposure of sensitive data, unauthorized access to internal services, and potentially even the execution of malicious code on systems accessible from the lollms-webui server. The impact is amplified if the server has access to privileged credentials or is part of a larger, interconnected network, enabling lateral movement and a wider blast radius.

1. Reserved2024-12-18
2. Published2025-03-20
3. EPSS updated2026-04-02

While a direct patch for CVE-2024-12766 is pending, several mitigation strategies can reduce the risk. The most effective is to restrict outbound network access from the lollms-webui server, limiting its ability to make requests to external resources. Implement strict URL validation on the /api/proxy endpoint, rejecting requests with invalid or suspicious URLs. Consider using a Web Application Firewall (WAF) to filter malicious requests and block SSRF attempts. Regularly review and update the server's configuration, ensuring that security mechanisms like forbidremoteaccess and check_access are properly configured and enforced. After implementing these workarounds, verify their effectiveness by attempting to trigger the SSRF vulnerability with a controlled, non-harmful URL.