CVE-2024-2358

{"id": "CVE-2024-2358", "metrics": {"cvssMetricV30": [{"type": "Secondary", "source": "security@huntr.dev", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2024-05-16T09:15:09.800", "references": [{"url": "https://huntr.com/bounties/b2771df3-be50-45bd-93c4-0974ce38bc22", "source": "security@huntr.dev"}, {"url": "https://huntr.com/bounties/b2771df3-be50-45bd-93c4-0974ce38bc22", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security@huntr.dev", "description": [{"lang": "en", "value": "CWE-29"}]}], "descriptions": [{"lang": "en", "value": "A path traversal vulnerability in the '/apply_settings' endpoint of parisneo/lollms-webui allows attackers to execute arbitrary code. The vulnerability arises due to insufficient sanitization of user-supplied input in the configuration settings, specifically within the 'extensions' parameter. Attackers can exploit this by crafting a payload that includes relative path traversal sequences ('../../../'), enabling them to navigate to arbitrary directories. This flaw subsequently allows the server to load and execute a malicious '__init__.py' file, leading to remote code execution. The issue affects the latest version of parisneo/lollms-webui."}, {"lang": "es", "value": "Una vulnerabilidad de path traversal en el endpoint '/apply_settings' de parisneo/lollms-webui permite a los atacantes ejecutar c\u00f3digo arbitrario. La vulnerabilidad surge debido a una desinfecci\u00f3n insuficiente de la entrada proporcionada por el usuario en los ajustes de configuraci\u00f3n, espec\u00edficamente dentro del par\u00e1metro 'extensions'. Los atacantes pueden aprovechar esto manipulando un payload que incluya secuencias de path traversal relativo ('../../../'), lo que les permite navegar a directorios arbitrarios. Esta falla posteriormente permite que el servidor cargue y ejecute un archivo '__init__.py' malicioso, lo que lleva a la ejecuci\u00f3n remota de c\u00f3digo. El problema afecta a la \u00faltima versi\u00f3n de parisneo/lollms-webui."}], "lastModified": "2024-11-21T09:09:35.293", "sourceIdentifier": "security@huntr.dev"}