CVE-2024-2361: Arbitrary Upload & Read via Path Traversal in parisneo/lollms-webui
A vulnerability in the parisneo/lollms-webui allows for arbitrary file upload and read due to insufficient sanitization of user-supplied input. Specifically, the issue resides in the installmodel() function within lollmscore/lollms/binding.py, where the application fails to properly sanitize the file:// protocol and other inputs, leading to arbitrary read and upload capabilities. Attackers can exploit this vulnerability by manipulating the path and variantname parameters to achieve path traversal, allowing for the reading of arbitrary files and uploading files to arbitrary locations on the server. This vulnerability affects the latest version of parisneo/lollms-webui.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-2361?
The severity of CVE-2024-2361 has been designated as high due to its potential for arbitrary file upload and read.
How do I fix CVE-2024-2361?
To fix CVE-2024-2361, ensure proper sanitization of user-supplied inputs in the 'install_model()' function of the application.
What systems are affected by CVE-2024-2361?
CVE-2024-2361 affects the 'parisneo/lollms-webui' application.
What are the potential impacts of CVE-2024-2361?
The potential impacts of CVE-2024-2361 include unauthorized file uploads and exposure of sensitive information.
Is a patch available for CVE-2024-2361?
As of now, there is no official patch announced for CVE-2024-2361; users should monitor updates from the vendor.