CVE-2024-2360 Path Traversal leading to Remote Code Execution in parisneo/lollms-webui

Critical 9.8 Published 6 Jun 2024 Updated 1 Aug 2024

Attackers can exploit path traversal in lollms-webui settings to execute arbitrary code and read files on the server.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2024-2360?

CVE-2024-2360 is a critical path traversal vulnerability in parisneo/lollms-webui, published on 6 Jun 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

parisneo/lollms-webui is vulnerable to path traversal attacks that can lead to remote code execution due to insufficient sanitization of user-supplied input in the 'Database path' and 'PDF LaTeX path' settings. An attacker can exploit this vulnerability by manipulating these settings to execute arbitrary code on the targeted server. The issue affects the latest version of the software. The vulnerability stems from the application's handling of the 'discussion_db_name' and 'pdf_latex_path' parameters, which do not properly validate file paths, allowing for directory traversal. This vulnerability can also lead to further file exposure and other attack vectors by manipulating the 'discussion_db_name' parameter.

Weakness: CWE-22, CWE-29

Which versions are affected by CVE-2024-2360?

It affects 1 product.

Products include Lollms Lollms Web Ui.

How do I fix CVE-2024-2360?

No fix has been published for CVE-2024-2360 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2024-2360 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-2360 exists.

Sources

Also known as GHSA-67rj-2wcw-78m5.