CVE-2024-2358

The attacker sends a crafted request to the '/apply_settings' endpoint, providing path traversal sequences (e.g., '../../../') in the 'extensions' parameter, which allow escaping the permitted directory. The server, without properly validating the path, loads the '__init__.py' file indicated by the attacker from any location in the file system. Loading this file results in execution of the malicious code contained within it with the privileges of the server process. The vulnerability results from insufficient validation of configuration data supplied by the user.

An attacker can remotely execute arbitrary code on the server without authentication, leading to complete system compromise, data theft, and potential lateral movement within the network.

Apply patches available from the vendor according to the references. As a temporary measure, it is recommended to restrict network access to the lollms-webui interface exclusively to trusted IP addresses and avoid exposing the service on public networks.

The latest version of parisneo/lollms-webui (lollms Web UI) available at the time of vulnerability publication (2024-05-16)