parisneo lollms-webui up to 9.4 processor.py' path traversal

Summaryinfo

A vulnerability was found in parisneo lollms-webui up to 9.4. It has been classified as critical. The impacted element is an unknown function of the file lollms-webui/zoos/personalities_zoo/cyber_security/codeguard/scripts/processor.py'. This manipulation causes path traversal. This vulnerability is tracked as CVE-2024-3322. The attack is restricted to local execution. No exploit exists. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in parisneo lollms-webui up to 9.4. It has been declared as critical. Affected by this vulnerability is an unknown code block of the file lollms-webui/zoos/personalities_zoo/cyber_security/codeguard/scripts/processor.py'. The manipulation with an unknown input leads to a path traversal vulnerability. The CWE definition for the vulnerability is CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

A path traversal vulnerability exists in the 'cyber_security/codeguard' native personality of the parisneo/lollms-webui, affecting versions up to 9.5. The vulnerability arises from the improper limitation of a pathname to a restricted directory in the 'process_folder' function within 'lollms-webui/zoos/personalities_zoo/cyber_security/codeguard/scripts/processor.py'. Specifically, the function fails to properly sanitize user-supplied input for the 'code_folder_path', allowing an attacker to specify arbitrary paths using '../' or absolute paths. This flaw leads to arbitrary file read and overwrite capabilities in specified directories without limitations, posing a significant risk of sensitive information disclosure and unauthorized file manipulation.

It is possible to read the advisory at huntr.com. This vulnerability is known as CVE-2024-3322 since 04/04/2024. The exploitation appears to be easy. Attacking locally is a requirement. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1006 according to MITRE ATT&CK.

Upgrading to version 9.5 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• parisneo

Name

• lollms-webui

Version

• 9.0
• 9.1
• 9.2
• 9.3
• 9.4

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion