PT-2024-20964 · Parisneo · Lollms-Webui

Published 2024-06-06 · Updated 2024-10-17 · CVE-2024-2548

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions parisneo/lollms-webui versions prior to 9.5

Description A path traversal vulnerability exists in the parisneo/lollms-webui application, specifically within the lollms core/lollms/server/endpoints/lollms binding files server.py and lollms core/lollms/security.py files. Due to inadequate validation of file paths between Windows and Linux environments using Path(path).is absolute(), attackers can exploit this flaw to read any file on the system. The vulnerability is triggered when an attacker sends a specially crafted request to the "/user infos/{path:path}" endpoint, allowing the reading of arbitrary files, as demonstrated with the win.ini file.

Recommendations For versions prior to 9.5, update to version 9.5 to resolve the issue. As a temporary workaround, consider restricting access to the /user infos/{path:path} endpoint until the update is applied. Avoid using the path parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

CWE-36

Related Identifiers

CVE-2024-2548

Affected Products

Lollms-Webui

References · 6

• 🔥 https://huntr.com/bounties/65979513-db0d-46fd-9977-fcd73bcd8a41 · Exploit
• https://github.com/parisneo/lollms-webui/commit/49b0332e98d42dd5204dda53dee410b160106265 · Patch
• https://osv.dev/vulnerability/CVE-2024-2548 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-2548 · Security Note
• https://twitter.com/CVEnew/status/1798781380857614781 · Twitter Post
• https://t.me/cvenotify/98540 · Telegram Post