CVE-2024-6581

攻击者可以利用此漏洞上传包含恶意 JavaScript 代码的 SVG 文件。当其他授权用户访问包含该恶意 SVG 文件的 URL 时，JavaScript 代码将在用户的浏览器中执行。这可能导致攻击者窃取用户的敏感信息，例如会话 Cookie，或者冒充用户执行未经授权的操作。更严重的情况下，攻击者可能利用 XSS 漏洞进一步执行远程代码，完全控制受影响的系统。由于该漏洞的 CVSS 评分为 CRITICAL，因此其潜在影响非常严重，需要立即修复。

Users of Lollms who rely on the discussion image upload feature are at risk. This includes individuals and organizations using Lollms for collaborative projects, educational purposes, or any scenario where users can upload images to discussions. Specifically, those running older versions (≤11.0.0) are particularly vulnerable.

• python: Examine Lollms application logs for suspicious SVG file uploads or unusual HTTP requests containing SVG content.

# Example: Check for SVG uploads in logs
with open('lollms.log', 'r') as f:
    for line in f:
        if '.svg' in line and 'Content-Type: image/svg+xml' in line:
            print(f'Potential SVG upload detected: {line}')

• generic web: Monitor access logs for requests to the discussion image upload endpoint with SVG files. Look for unusual user agent strings or referrer headers.

# Example: grep for SVG uploads in access logs
grep '.svg' /var/log/apache2/access.log

• generic web: Inspect response headers for unexpected JavaScript code execution. Use browser developer tools to examine the DOM for injected scripts.

1. 2024-10-29Disclosure

   disclosure

1. 已保留2024-07-08
2. 发布日期2024-10-29
3. 修改日期2025-10-09
4. EPSS 更新日期2026-04-02

最有效的缓解措施是立即将 Lollms 应用升级至 9.9 或更高版本。如果无法立即升级，可以考虑以下临时缓解措施：首先，严格限制用户上传文件的类型，只允许上传安全的图片格式。其次，实施严格的输入验证和输出编码，确保所有用户上传的文件都经过充分的过滤和消毒。此外，可以考虑使用 Web 应用防火墙 (WAF) 来检测和阻止恶意 SVG 文件的上传。最后，定期审查 Lollms 应用的配置，确保其安全性。