Arbitrary File Upload and Read Vulnerability in parisneo/lollms-webui

CVE-2024-2361

Summary

A vulnerability in Parisneo's Lollms-Webui facilitates arbitrary file uploads and reads due to inadequate sanitization of inputs provided by users. The flaw is located in the install_model() function within lollms_core/lollms/binding.py, which does not properly handle the file:// protocol among other inputs. This allows malicious actors to exploit the vulnerability by manipulating the path and variant_name parameters, thus gaining unauthorized access to read arbitrary files and upload files to any location on the server. The vulnerability poses significant risks as it opens pathways for unauthorized data exposure and system compromise.

References