CVE-2024-2624

{"id": "CVE-2024-2624", "metrics": {"cvssMetricV30": [{"type": "Secondary", "source": "security@huntr.dev", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 9.4, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 5.5, "exploitabilityScore": 3.9}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2024-06-06T19:15:55.437", "references": [{"url": "https://github.com/parisneo/lollms-webui/commit/aeba79f3ea934331b8ecd625a58bae6e4f7e7d3f", "tags": ["Patch"], "source": "security@huntr.dev"}, {"url": "https://huntr.com/bounties/39e17897-0e92-4473-91c7-f728322191aa", "tags": ["Exploit", "Third Party Advisory"], "source": "security@huntr.dev"}, {"url": "https://github.com/parisneo/lollms-webui/commit/aeba79f3ea934331b8ecd625a58bae6e4f7e7d3f", "tags": ["Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://huntr.com/bounties/39e17897-0e92-4473-91c7-f728322191aa", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security@huntr.dev", "description": [{"lang": "en", "value": "CWE-29"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "A path traversal and arbitrary file upload vulnerability exists in the parisneo/lollms-webui application, specifically within the `@router.get(\"/switch_personal_path\")` endpoint in `./lollms-webui/lollms_core/lollms/server/endpoints/lollms_user.py`. The vulnerability arises due to insufficient sanitization of user-supplied input for the `path` parameter, allowing an attacker to specify arbitrary file system paths. This flaw enables direct arbitrary file uploads, leakage of `personal_data`, and overwriting of configurations in `lollms-webui`->`configs` by exploiting the same named directory in `personal_data`. The issue affects the latest version of the application and is fixed in version 9.4. Successful exploitation could lead to sensitive information disclosure, unauthorized file uploads, and potentially remote code execution by overwriting critical configuration files."}, {"lang": "es", "value": "Existe una vulnerabilidad de path traversal y carga de archivos arbitrarios en la aplicaci\u00f3n parisneo/lollms-webui, espec\u00edficamente dentro del endpoint `@router.get(\"/switch_personal_path\")` en `./lollms-webui/lollms_core/lollms/server/endpoints/ lollms_user.py`. La vulnerabilidad surge debido a una sanitizaci\u00f3n insuficiente de la entrada proporcionada por el usuario para el par\u00e1metro \"ruta\", lo que permite a un atacante especificar rutas arbitrarias del sistema de archivos. Esta falla permite la carga directa de archivos arbitrarios, la fuga de `personal_data` y la sobrescritura de configuraciones en `lollms-webui`->`configs` al explotar el mismo directorio con el mismo nombre en `personal_data`. El problema afecta a la \u00faltima versi\u00f3n de la aplicaci\u00f3n y se solucion\u00f3 en la versi\u00f3n 9.4. Una explotaci\u00f3n exitosa podr\u00eda conducir a la divulgaci\u00f3n de informaci\u00f3n confidencial, cargas de archivos no autorizadas y ejecuci\u00f3n potencialmente remota de c\u00f3digo al sobrescribir archivos de configuraci\u00f3n cr\u00edticos."}], "lastModified": "2024-11-21T09:10:09.430", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:lollms:lollms_web_ui:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E8DA02EF-1A49-47C3-B2E4-5F70C25D8B34", "versionEndExcluding": "9.4"}], "operator": "OR"}]}], "sourceIdentifier": "security@huntr.dev"}