PT-2024-36319 · Parisneo · Lollms

Published 2024-06-22 · Updated 2024-06-24 · CVE-2024-5443

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: parisneo/lollms versions prior to 9.5.1

Description: The issue arises from a path traversal vulnerability in the /mount extension endpoint, where the data.category and data.folder parameters can accept empty strings, leading to inadequate input sanitization. This allows attackers to construct a package path that points to the root directory. If an attacker can create a config.yaml file in a controllable path, this path can be appended to the extensions list and trigger the execution of init .py in the current directory, resulting in remote code execution.

Recommendations: For versions prior to 9.5.1, update to version 9.5.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the /mount extension endpoint and limiting the ability to create config.yaml files in controllable paths until a patch is applied. Additionally, disabling the ExtensionBuilder().build extension() function can help mitigate the risk of exploitation.

Fix

Weakness Enumeration

CWE-29

Related Identifiers

CVE-2024-5443

GHSA-MVRM-FH8Q-6WR2

Affected Products

Lollms

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2024-5443 · Security Note
• https://osv.dev/vulnerability/GHSA-mvrm-fh8q-6wr2 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-5443 · Vendor Advisory
• https://github.com/ParisNeo/lollms · Note
• https://github.com/parisneo/lollms/commit/2d0c4e76be93195836ecd0948027e791b8a2626f · Note
• https://huntr.com/bounties/db52848a-4dbe-4110-a981-03739834bf45 · Note
• https://twitter.com/CveFindCom/status/1804552596486521343 · Twitter Post
• https://t.me/cvenotify/84118 · Telegram Post
• https://twitter.com/CVEnew/status/1804549085954732423 · Twitter Post