Path Traversal in parisneo/lollms-webui

Vulnerability

Description

CVE-2024-4330 is a path traversal vulnerability in the parisneo/lollms-webui repository, version 9.6. The flaw resides in the list_personalities endpoint within the endpoints/lollms_advanced.py file. The application fails to properly sanitize user-supplied input for the category parameter, allowing an attacker to traverse directories via a crafted HTTP request [1].

Exploitation

An attacker can exploit this by sending a malicious request where the category parameter contains path traversal sequences (e.g., ../). Successful exploitation reveals the names of subfolders in arbitrary directories, but not the contents of files. The issue was demonstrated by manipulating the category parameter to access directories outside the intended scope [3].

Impact

While only subfolder names are disclosed, this information can aid attackers in mapping the directory structure, potentially leading to further attacks. The vulnerability is classified as low severity due to the limited disclosure, but it violates the principle of least privilege and may expose sensitive paths [1].

Mitigation

As of the publication date (2024-05-30), a patch has not been confirmed. Users of version 9.6 should monitor the official repository [2] for updates and apply any fixes promptly. The issue was reported via a bug bounty platform [3], suggesting the vendor may be working on a resolution.