CVE-2024-2361

Path Traversal: '\..\filename' (CWE-29)

Published: May 16, 2024 / Updated: 6mo ago

010
No CVSS yetEPSS 0.04%
CVE info copied to clipboard

A vulnerability in the parisneo/lollms-webui allows for arbitrary file upload and read due to insufficient sanitization of user-supplied input. Specifically, the issue resides in the `install_model()` function within `lollms_core/lollms/binding.py`, where the application fails to properly sanitize the `file://` protocol and other inputs, leading to arbitrary read and upload capabilities. Attackers can exploit this vulnerability by manipulating the `path` and `variant_name` parameters to achieve path traversal, allowing for the reading of arbitrary files and uploading files to arbitrary locations on the server. This vulnerability affects the latest version of parisneo/lollms-webui.

Timeline

CVE Assignment

NVD published the first details for CVE-2024-2361

May 16, 2024 at 9:15 AM
First Article

Feedly found the first article mentioning CVE-2024-2361. See article

May 16, 2024 at 9:22 AM / National Vulnerability Database
CVSS Estimate

Feedly estimated the CVSS score as HIGH

May 16, 2024 at 9:22 AM
EPSS

EPSS Score was set to: 0.04% (Percentile: 8.6%)

May 17, 2024 at 10:02 AM
Static CVE Timeline Graph

News

NA - CVE-2024-2361 - A vulnerability in the parisneo/lollms-webui...
A vulnerability in the parisneo/lollms-webui allows for arbitrary file upload and read due to insufficient sanitization of user-supplied input. Specifically, the issue resides in the...
Arbitrary File Upload and Read Vulnerability in parisneo/lollms-webui
Parisneo - CRITICAL - CVE-2024-2361 A vulnerability in the parisneo/lollms-webui allows for arbitrary file upload and read due to insufficient sanitization of user-supplied input. Specifically, the issue resides in the `install_model()` function within `lollms_core/lollms/binding.py`, where the application fails to properly sanitize the `file://` protocol and other inputs, leading to arbitrary read and upload capabilities. Attackers can exploit this vulnerability by manipulating the `path` and `variant_name` parameters to achieve path traversal, allowing for the reading of arbitrary files and uploading files to arbitrary locations on the server. This vulnerability affects the latest version of parisneo/lollms-webui.
CVE-2024-2361 | parisneo lollms-webui binding.py install_model path traversal
A vulnerability, which was classified as very critical , was found in parisneo lollms-webui . This affects the function install_model of the file lollms_core/lollms/binding.py . The manipulation leads to path traversal: '\..\filename'. This vulnerability is uniquely identified as CVE-2024-2361 . It is possible to initiate the attack remotely. There is no exploit available.
CVE-2024-2361 - A vulnerability in the parisneo/lollms-webui allow
CVE ID : CVE-2024-2361 Published : May 16, 2024, 9:15 a.m. 17 minutes ago Description : A vulnerability in the parisneo/lollms-webui allows for arbitrary file upload and read due to insufficient sanitization of user-supplied input. Specifically, the issue resides in the `install_model()` function within `lollms_core/lollms/binding.py`, where the application fails to properly sanitize the `file://` protocol and other inputs, leading to arbitrary read and upload capabilities. Attackers can exploit this vulnerability by manipulating the `path` and `variant_name` parameters to achieve path traversal, allowing for the reading of arbitrary files and uploading files to arbitrary locations on the server. This vulnerability affects the latest version of parisneo/lollms-webui. Severity:
CVE-2024-2361
A vulnerability in the parisneo/lollms-webui allows for arbitrary file upload and read due to insufficient sanitization of user-supplied input. Specifically, the issue resides in the `install_model()` function within `lollms_core/lollms/binding.py`, where the application fails to properly sanitize the `file://` protocol and other inputs, leading to arbitrary read and upload capabilities. Attackers can exploit this vulnerability by manipulating the `path` and `variant_name` parameters to achieve path traversal, allowing for the reading of arbitrary files and uploading files to arbitrary locations on the server. This vulnerability affects the latest version of parisneo/lollms-webui.

CVSS V3.1

Unknown

Categories

Be the first to know about critical vulnerabilities

Collect, analyze, and share vulnerability reports faster using AI