Path Traversal and OS Command Injection Vulnerability in Parisneo's Lollms Web UI

CVE-2024-10019

Summary

A vulnerability exists in the 'start_app_server' function of Parisneo's Lollms Web UI V12 (Strawberry) that permits attackers to execute arbitrary code via path traversal and OS command injection. The vulnerability arises because the function inadequately sanitizes the 'app_name' parameter, allowing a malicious user to upload a compromised 'server.py' file. This exploitation can lead to severe security implications, as attackers gain the ability to execute unauthorized commands on the server.

References