THREATINT

We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Zendesk (Helpdesk and Chat)

Ok

PUBLISHED

CVE-2024-2358

Path Traversal leading to Remote Code Execution in parisneo/lollms-webui

Reserved:2024-03-09
Published:2024-05-16
Updated:2024-05-16

Description

A path traversal vulnerability in the '/apply_settings' endpoint of parisneo/lollms-webui allows attackers to execute arbitrary code. The vulnerability arises due to insufficient sanitization of user-supplied input in the configuration settings, specifically within the 'extensions' parameter. Attackers can exploit this by crafting a payload that includes relative path traversal sequences ('../../../'), enabling them to navigate to arbitrary directories. This flaw subsequently allows the server to load and execute a malicious '__init__.py' file, leading to remote code execution. The issue affects the latest version of parisneo/lollms-webui.



CRITICAL: 9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Problem types

CWE-29 Path Traversal: '\..\filename'

Product status

Any version
affected

References

https://huntr.com/bounties/b2771df3-be50-45bd-93c4-0974ce38bc22

cve.org CVE-2024-2358

nvd.nist.gov CVE-2024-2358

Download JSON

Share this page
https://cve.threatint.com/CVE/CVE-2024-2358