text-generation-webui: Arbitrary File Overwrite and Execution via Malicious Extension Settings
Overview
The text-generation-webui application, prior to version 4.1.1, suffers from a critical vulnerability that allows for arbitrary file overwrite and subsequent remote code execution. The core issue lies in the handling of extension settings when saved in Python (`.py`) format. Users are permitted to save these settings within the application's root directory. An attacker, by crafting a malicious extension setting file, can overwrite existing Python files crucial to the application's operation. Specifically, a common target is the `download-model.py` script. Once this script is replaced with malicious code, it can be triggered through the 'Model' menu when a user attempts to download a new language model. This mechanism effectively turns a legitimate user action into an execution vector for the attacker's payload, granting them control over the server or system running text-generation-webui.
Affected Systems
Testing Guide
1. Verify the current installed version of text-generation-webui. If it is 4.1.1 or newer, you are not affected. 2. If using an older version, attempt to create an extension with a `.py` file extension and save its settings to the application root. 3. Check if you can create a malicious Python script (e.g., a simple script that creates a file) and save it as an extension setting in the app root, overwriting a legitimate file like `download-model.py`. 4. Try to trigger the execution of the overwritten script by navigating to the 'Model' menu and initiating a model download.
Mitigation Steps
- Ensure that text-generation-webui is updated to version 4.1.1 or later. - Restrict write access to the application's root directory for untrusted users or processes. - Implement strict input validation on uploaded extension configuration files, disallowing Python file extensions in user-saved settings. - Consider disabling the saving of extension settings in Python format if not strictly necessary for your deployment. - Regularly audit application logs for suspicious file modification or execution events.
Patch Details
Version 4.1.1