parisneo lollms-webui up to 9.3 on Windows Request del_preset absolute path traversal

Summaryinfo

A vulnerability classified as critical has been found in parisneo lollms-webui up to 9.3 on Windows. This affects an unknown part of the file del_preset of the component Request Handler. Performing a manipulation results in absolute path traversal. This vulnerability is reported as CVE-2024-2362. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability, which was classified as critical, was found in parisneo lollms-webui up to 9.3 on Windows. This affects some unknown processing of the file del_preset of the component Request Handler. The manipulation with an unknown input leads to a absolute path traversal vulnerability. CWE is classifying the issue as CWE-36. The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize absolute path sequences such as "/abs/path" that can resolve to a location that is outside of that directory. This is going to have an impact on integrity, and availability. The summary by CVE is:

A path traversal vulnerability exists in the parisneo/lollms-webui version 9.3 on the Windows platform. Due to improper validation of file paths between Windows and Linux environments, an attacker can exploit this vulnerability to delete any file on the system. The issue arises from the lack of adequate sanitization of user-supplied input in the 'del_preset' endpoint, where the application fails to prevent the use of absolute paths or directory traversal sequences ('..'). As a result, an attacker can send a specially crafted request to the 'del_preset' endpoint to delete files outside of the intended directory.

The advisory is shared at huntr.com. This vulnerability is uniquely identified as CVE-2024-2362 since 03/10/2024. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 10/18/2024). MITRE ATT&CK project uses the attack technique T1006 for this issue.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• parisneo

Name

• lollms-webui

Version

• 9.0
• 9.1
• 9.2
• 9.3

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion