CVE-2024-2624

A path traversal and arbitrary file upload vulnerability exists in the parisneo/lollms-webui application, specifically within the `@router.get("/switch_personal_path")` endpoint in `./lollms-webui/lollms_core/lollms/server/endpoints/lollms_user.py`. The vulnerability arises due to insufficient sanitization of user-supplied input for the `path` parameter, allowing an attacker to specify arbitrary file system paths. This flaw enables direct arbitrary file uploads, leakage of `personal_data`, and overwriting of configurations in `lollms-webui`->`configs` by exploiting the same named directory in `personal_data`. The issue affects the latest version of the application and is fixed in version 9.4. Successful exploitation could lead to sensitive information disclosure, unauthorized file uploads, and potentially remote code execution by overwriting critical configuration files.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/parisneo/lollms-webui/commit/aeba79f3ea934331b8ecd625a58bae6e4f7e7d3f	Patch
https://huntr.com/bounties/39e17897-0e92-4473-91c7-f728322191aa	Exploit Third Party Advisory
https://github.com/parisneo/lollms-webui/commit/aeba79f3ea934331b8ecd625a58bae6e4f7e7d3f	Patch
https://huntr.com/bounties/39e17897-0e92-4473-91c7-f728322191aa	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:lollms:lollms_web_ui:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2024-06-06 19:15

Updated : 2024-11-21 09:10

NVD link : CVE-2024-2624

Mitre link : CVE-2024-2624

CVE.ORG link : CVE-2024-2624

JSON object : View

Products Affected

lollms

lollms_web_ui

CWE

CWE-29

Path Traversal: '\..\filename'

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2024-2624", "cveTags": [], "metrics": {"cvssMetricV30": [{"type": "Secondary", "source": "security@huntr.dev", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 9.4, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 5.5, "exploitabilityScore": 3.9}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2024-06-06T19:15:55.437", "references": [{"url": "https://github.com/parisneo/lollms-webui/commit/aeba79f3ea934331b8ecd625a58bae6e4f7e7d3f", "tags": ["Patch"], "source": "security@huntr.dev"}, {"url": "https://huntr.com/bounties/39e17897-0e92-4473-91c7-f728322191aa", "tags": ["Exploit", "Third Party Advisory"], "source": "security@huntr.dev"}, {"url": "https://github.com/parisneo/lollms-webui/commit/aeba79f3ea934331b8ecd625a58bae6e4f7e7d3f", "tags": ["Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://huntr.com/bounties/39e17897-0e92-4473-91c7-f728322191aa", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security@huntr.dev", "description": [{"lang": "en", "value": "CWE-29"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "A path traversal and arbitrary file upload vulnerability exists in the parisneo/lollms-webui application, specifically within the `@router.get(\"/switch_personal_path\")` endpoint in `./lollms-webui/lollms_core/lollms/server/endpoints/lollms_user.py`. The vulnerability arises due to insufficient sanitization of user-supplied input for the `path` parameter, allowing an attacker to specify arbitrary file system paths. This flaw enables direct arbitrary file uploads, leakage of `personal_data`, and overwriting of configurations in `lollms-webui`->`configs` by exploiting the same named directory in `personal_data`. The issue affects the latest version of the application and is fixed in version 9.4. Successful exploitation could lead to sensitive information disclosure, unauthorized file uploads, and potentially remote code execution by overwriting critical configuration files."}, {"lang": "es", "value": "Existe una vulnerabilidad de path traversal y carga de archivos arbitrarios en la aplicaci\u00f3n parisneo/lollms-webui, espec\u00edficamente dentro del endpoint `@router.get(\"/switch_personal_path\")` en `./lollms-webui/lollms_core/lollms/server/endpoints/ lollms_user.py`. La vulnerabilidad surge debido a una sanitizaci\u00f3n insuficiente de la entrada proporcionada por el usuario para el par\u00e1metro \"ruta\", lo que permite a un atacante especificar rutas arbitrarias del sistema de archivos. Esta falla permite la carga directa de archivos arbitrarios, la fuga de `personal_data` y la sobrescritura de configuraciones en `lollms-webui`->`configs` al explotar el mismo directorio con el mismo nombre en `personal_data`. El problema afecta a la \u00faltima versi\u00f3n de la aplicaci\u00f3n y se solucion\u00f3 en la versi\u00f3n 9.4. Una explotaci\u00f3n exitosa podr\u00eda conducir a la divulgaci\u00f3n de informaci\u00f3n confidencial, cargas de archivos no autorizadas y ejecuci\u00f3n potencialmente remota de c\u00f3digo al sobrescribir archivos de configuraci\u00f3n cr\u00edticos."}], "lastModified": "2024-11-21T09:10:09.430", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:lollms:lollms_web_ui:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E8DA02EF-1A49-47C3-B2E4-5F70C25D8B34", "versionEndExcluding": "9.4"}], "operator": "OR"}]}], "sourceIdentifier": "security@huntr.dev"}