CVE-2024-2624 Path Traversal and Arbitrary File Upload Vulnerability in parisneo/lollms-webui
Attackers can exploit path traversal to upload arbitrary files, leak personal data, and potentially execute code by overwriting configuration files.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-2624?
CVE-2024-2624 is a critical path traversal vulnerability in parisneo/lollms-webui, published on 6 Jun 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A path traversal and arbitrary file upload vulnerability exists in the parisneo/lollms-webui application, specifically within the `@router.get("/switch_personal_path")` endpoint in `./lollms-webui/lollms_core/lollms/server/endpoints/lollms_user.py`. The vulnerability arises due to insufficient sanitization of user-supplied input for the `path` parameter, allowing an attacker to specify arbitrary file system paths. This flaw enables direct arbitrary file uploads, leakage of `personal_data`, and overwriting of configurations in `lollms-webui`->`configs` by exploiting the same named directory in `personal_data`. The issue affects the latest version of the application and is fixed in version 9.4. Successful exploitation could lead to sensitive information disclosure, unauthorized file uploads, and potentially remote code execution by overwriting critical configuration files.
Which versions are affected by CVE-2024-2624?
It affects 1 product.
Products include Lollms Lollms Web Ui.
How do I fix CVE-2024-2624?
No fix has been published for CVE-2024-2624 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2024-2624 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-2624 exists.
Other vulnerabilities in parisneo/lollms-webui
- CVE-2024-2359 Improper Neutralization of Special Elements used in an OS Command in parisneo/lollms-webui
- CVE-2024-2360 Path Traversal leading to Remote Code Execution in parisneo/lollms-webui
- CVE-2024-4320 Remote Code Execution due to LFI in '/install_extension' in parisneo/lollms-webui
- CVE-2024-2358 Path Traversal leading to Remote Code Execution in parisneo/lollms-webui
- CVE-2024-4326 Remote Code Execution via `/apply_settings` and `/execute_code` in parisneo/lollms-webui
Sources
Also known as GHSA-5p62-ppjr-4c45.