A path traversal vulnerability exists in the parisneo/lollms-webui application, specifically within the `lollms_core/lollms/server/endpoints/lollms_binding_files_server.py` and `lollms_core/lollms/security.py` files. Due to inadequate validation of file paths between Windows and Linux environments using `Path(path).is_absolute()`, attackers can exploit this flaw to read any file on the system. This issue affects the latest version of LoLLMs running on the Windows platform. The vulnerability is triggered when an attacker sends a specially crafted request to the `/user_infos/{path:path}` endpoint, allowing the reading of arbitrary files, as demonstrated with the `win.ini` file. The issue has been addressed in version 9.5 of the software.
References
Link | Resource |
---|---|
https://github.com/parisneo/lollms-webui/commit/49b0332e98d42dd5204dda53dee410b160106265 | Patch |
https://huntr.com/bounties/65979513-db0d-46fd-9977-fcd73bcd8a41 | Exploit Third Party Advisory |
Configurations
History
17 Oct 2024, 15:52
Type | Values Removed | Values Added |
---|---|---|
CWE | CWE-22 | |
First Time |
Lollms lollms Web Ui
Lollms |
|
CPE | cpe:2.3:a:lollms:lollms_web_ui:*:*:*:*:*:*:*:* | |
References | () https://github.com/parisneo/lollms-webui/commit/49b0332e98d42dd5204dda53dee410b160106265 - Patch | |
References | () https://huntr.com/bounties/65979513-db0d-46fd-9977-fcd73bcd8a41 - Exploit, Third Party Advisory |
07 Jun 2024, 14:56
Type | Values Removed | Values Added |
---|---|---|
Summary |
|
06 Jun 2024, 19:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2024-06-06 19:15
Updated : 2024-10-17 15:52
NVD link : CVE-2024-2548
Mitre link : CVE-2024-2548
CVE.ORG link : CVE-2024-2548
JSON object : View
Products Affected
lollms
- lollms_web_ui