Vulnerability Description
parisneo/lollms-webui is vulnerable to path traversal and denial of service attacks due to an exposed `/select_database` endpoint in version a9d16b0. The endpoint improperly handles file paths, allowing attackers to specify absolute paths when interacting with the `DiscussionsDB` instance. This flaw enables attackers to create directories anywhere on the system where the application has permissions, potentially leading to denial of service by creating directories with names of critical files, such as HTTPS certificate files, causing server startup failures. Additionally, attackers can manipulate the database path, resulting in the loss of client data by constantly changing the file location to an attacker-controlled location, scattering the data across the filesystem and making recovery difficult.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Lollms | Lollms Web Ui | - |
Related Weaknesses (CWE)
References
- https://github.com/parisneo/lollms-webui/commit/02e829b5653a1aa5dbbe9413ec84f96c
- https://huntr.com/bounties/c1cfc0d9-517a-4d0e-bf1c-6444c1fd195dThird Party Advisory
- https://huntr.com/bounties/c1cfc0d9-517a-4d0e-bf1c-6444c1fd195dThird Party Advisory
FAQ
What is CVE-2024-1873?
CVE-2024-1873 is a vulnerability with a CVSS score of 9.1 (CRITICAL). parisneo/lollms-webui is vulnerable to path traversal and denial of service attacks due to an exposed `/select_database` endpoint in version a9d16b0. The endpoint improperly handles file paths, allowi...
How severe is CVE-2024-1873?
CVE-2024-1873 has been rated CRITICAL with a CVSS base score of 9.1/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2024-1873?
Check the references section above for vendor advisories and patch information. Affected products include: Lollms Lollms Web Ui.