Arbitrary Code Execution Vulnerability in Parisneo/Lollms-Webui

CVE-2024-2358

Summary

A path traversal vulnerability exists in the '/apply_settings' endpoint of the parisneo/lollms-webui, allowing attackers to execute arbitrary code due to inadequate sanitization of user-supplied input in the configuration settings, particularly within the 'extensions' parameter. By crafting specially designed payloads that include relative path traversal sequences such as '../../../', an attacker can manipulate the input to navigate to unintended directories. This exploitation capability enables unauthorized loading and execution of a malicious 'init.py' file on the server, leading to a significant security compromise for users of the affected product.

References