CVE-2024-5443

Path Traversal: '\..\filename' (CWE-29)

Published: Jun 22, 2024 / Updated: 5mo ago

010
No CVSS yetEPSS 0.04%
CVE info copied to clipboard

Summary

CVE-2024-5443 is a path traversal vulnerability in the parisneo/lollms software, specifically in the ExtensionBuilder().build_extension() function. The /mount_extension endpoint allows attackers to navigate beyond the intended directory structure due to improper input validation of the data.category and data.folder parameters. By creating a config.yaml file in a controlled path, an attacker can execute __init__.py and achieve remote code execution. This vulnerability affects versions up to 5.9.0.

Impact

This vulnerability allows remote attackers to execute arbitrary code on the vulnerable system, leading to complete system compromise. Attackers could steal sensitive data, install malware, disrupt services, or gain persistent control over the system.

Exploitation

There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.

Patch

A patch has been released in version 9.8 to address this vulnerability. Users are strongly recommended to update to the patched version immediately.

Mitigation

If patching is not possible immediately, apply input validation on the data.category and data.folder parameters to prevent path traversal attacks. Monitor for any suspicious activity and restrict access to the vulnerable system as much as possible until it can be patched.

Timeline

CVE Assignment

NVD published the first details for CVE-2024-5443

Jun 22, 2024 at 5:15 PM
First Article

Feedly found the first article mentioning CVE-2024-5443. See article

Jun 22, 2024 at 5:24 PM / National Vulnerability Database
CVSS Estimate

Feedly estimated the CVSS score as HIGH

Jun 22, 2024 at 7:44 PM
EPSS

EPSS Score was set to: 0.04% (Percentile: 9.1%)

Jun 23, 2024 at 11:54 AM
CVSS

A CVSS base score of 9.8 has been assigned.

Jun 24, 2024 at 9:30 PM / github_advisories
Static CVE Timeline Graph

Patches

Github Advisory
+null more

Vendor Advisory

[GHSA-mvrm-fh8q-6wr2] Remote Code Execution via path traversal bypass in lollms
The vulnerability arises from the /mount_extension endpoint, where a path traversal issue allows attackers to navigate beyond the intended directory structure. CVE-2024-4320 describes a vulnerability in the parisneo/lollms software, specifically within the ExtensionBuilder().build_extension() function.

News

About LoLLMS WebUI: CVE-2024-5443 design flaw related to CVE-2024-4320 (NVD Last Modified: 06/24/2024)
These can be understood as more advanced versions of large language models (LLMs) that can work not only on text but diverse data types. 4.Lord of Large Language Models (LoLLMs) are ready
[GHSA-mvrm-fh8q-6wr2] Remote Code Execution via path traversal bypass in lollms
The vulnerability arises from the /mount_extension endpoint, where a path traversal issue allows attackers to navigate beyond the intended directory structure. CVE-2024-4320 describes a vulnerability in the parisneo/lollms software, specifically within the ExtensionBuilder().build_extension() function.
CVE-2024-5443
Critical Severity Description CVE-2024-4320 describes a vulnerability in the parisneo/lollms software, specifically within the `ExtensionBuilder().build_extension()` function. The vulnerability arises from the `/mount_extension` endpoint, where a path traversal issue allows attackers to navigate beyond the intended directory structure. This is facilitated by the `data.category` and `data.folder` parameters accepting empty strings (`""`), which, due to inadequate input sanitization, can lead to the construction of a `package_path` that points to the root directory. Consequently, if an attacker can create a `config.yaml` file in a controllable path, this path can be appended to the `extensions` list and trigger the execution of `__init__.py` in the current directory, leading to remote code execution. The vulnerability affects versions up to 5.9.0, and has been addressed in version 9.8. Read more at https://www.tenable.com/cve/CVE-2024-5443
A severe vulnerability was disclosed for parisneo lollms (CVE-2024-5443) https:// vuldb.com/?id.269483
CVE-2024-5443
The vulnerability arises from the `/mount_extension` endpoint, where a path traversal issue allows attackers to navigate beyond the intended directory structure. Gravedad 3.1 (CVSS 3.1 Base Score)
See 8 more articles and social media posts

CVSS V3.1

Unknown

Categories

Be the first to know about critical vulnerabilities

Collect, analyze, and share vulnerability reports faster using AI