CVE-2024-2624

Summary

A path traversal and arbitrary file upload vulnerability exists in the parisneo/lollms-webui application, specifically within the @router.get("/switch_personal_path") endpoint in ./lollms-webui/lollms_core/lollms/server/endpoints/lollms_user.py. The vulnerability arises due to insufficient sanitization of user-supplied input for the path parameter, allowing an attacker to specify arbitrary file system paths. This flaw enables direct arbitrary file uploads, leakage of personal_data, and overwriting of configurations in lollms-webui->configs by exploiting the same named directory in personal_data. The issue affects the latest version of the application and is fixed in version 9.4. Successful exploitation could lead to sensitive information disclosure, unauthorized file uploads, and potentially remote code execution by overwriting critical configuration files.

Affected Software

VendorProductVersion RangeStatus
parisneoparisneo/lollms-webuiunspecified < 9.4affected

Weaknesses

  • CWE-29: CWE-29 Path Traversal: '..\filename'

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: poc
    • Automatable: yes
    • Technical Impact: partial

CVE Program Container

Additional References

References