Path Traversal Vulnerability in Parisneo/Lollms Allows Remote Code Execution

CVE-2024-5443

Summary

A security vulnerability exists in the parisneo/lollms software, specifically in the ExtensionBuilder().build_extension() function, where improper input sanitization at the /mount_extension endpoint allows for path traversal. This vulnerability is triggered when the data.category and data.folder parameters are accepted as empty strings, enabling attackers to navigate outside of the intended directory structure. If an attacker can manipulate the environment to create a config.yaml file at a controllable path, they can exploit this to append it to the extensions list, leading to the execution of arbitrary code through __init__.py in the current directory. This vulnerability affects versions up to 5.9.0 and has been addressed in version 9.8.

References