CVE-2024-4498 Path Traversal and RFI Vulnerability in parisneo/lollms-webui

High 7.7 Published 25 Jun 2024 Updated 1 Aug 2024

Attackers can exploit path traversal and RFI in lollms-webui to upload and execute malicious code, leading to remote code execution.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2024-4498?

CVE-2024-4498 is a high-severity path traversal vulnerability in parisneo/lollms-webui, published on 25 Jun 2024. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

A Path Traversal and Remote File Inclusion (RFI) vulnerability exists in the parisneo/lollms-webui application, affecting versions v9.7 to the latest. The vulnerability arises from insufficient input validation in the `/apply_settings` function, allowing an attacker to manipulate the `discussion_db_name` parameter to traverse the file system and include arbitrary files. This issue is compounded by the bypass of input filtering in the `install_binding`, `reinstall_binding`, and `unInstall_binding` endpoints, despite the presence of a `sanitize_path_from_endpoint(data.name)` filter. Successful exploitation enables an attacker to upload and execute malicious code on the victim's system, leading to Remote Code Execution (RCE).

Weakness: CWE-22

Which versions are affected by CVE-2024-4498?

It affects 1 product.

Products include Lollms Lollms Web Ui.

How do I fix CVE-2024-4498?

No fix has been published for CVE-2024-4498 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2024-4498 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-4498 exists.

Sources

Also known as GHSA-4cwh-j7h3-gc75.