// For flags

CVE-2024-4498

Path Traversal and RFI Vulnerability in parisneo/lollms-webui

Severity Score

7.7
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Attend
*SSVC
Descriptions

A Path Traversal and Remote File Inclusion (RFI) vulnerability exists in the parisneo/lollms-webui application, affecting versions v9.7 to the latest. The vulnerability arises from insufficient input validation in the `/apply_settings` function, allowing an attacker to manipulate the `discussion_db_name` parameter to traverse the file system and include arbitrary files. This issue is compounded by the bypass of input filtering in the `install_binding`, `reinstall_binding`, and `unInstall_binding` endpoints, despite the presence of a `sanitize_path_from_endpoint(data.name)` filter. Successful exploitation enables an attacker to upload and execute malicious code on the victim's system, leading to Remote Code Execution (RCE).

Existe una vulnerabilidad de Path Traversal e inclusión remota de archivos (RFI) en la aplicación parisneo/lollms-webui, que afecta a las versiones v9.7 hasta la última. La vulnerabilidad surge de una validación de entrada insuficiente en la función `/apply_settings`, lo que permite a un atacante manipular el parámetro `discussion_db_name` para atravesar el sistema de archivos e incluir archivos arbitrarios. Este problema se ve agravado por la omisión del filtrado de entrada en los endpoints `install_binding`, `reinstall_binding` y `unInstall_binding`, a pesar de la presencia de un filtro `sanitize_path_from_endpoint(data.name)`. La explotación exitosa permite a un atacante cargar y ejecutar código malicioso en el sistema de la víctima, lo que lleva a la ejecución remota de código (RCE).

*Credits: N/A
CVSS Scores
Attack Vector
Local
Attack Complexity
High
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Partial
Integrity
Partial
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:Attend
Exploitation
Poc
Automatable
No
Tech. Impact
Total
* Organization's Worst-case Scenario
Timeline
  • 2024-05-04 CVE Reserved
  • 2024-06-25 CVE Published
  • 2024-06-26 EPSS Updated
  • 2024-08-01 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Parisneo
Search vendor "Parisneo"
 Lollms-webui
Search vendor "Parisneo" for product "Lollms-webui"
*-
Affected