CVE-2024-1600
📋 TL;DR
This CVE describes a Local File Inclusion vulnerability in the parisneo/lollms-webui application that allows attackers to read arbitrary files on the server filesystem. Attackers can exploit this by sending specially crafted URLs with directory traversal sequences to the /personalities route. All deployments of the affected lollms-webui versions are vulnerable if exposed to untrusted networks.
💻 Affected Systems
- parisneo/lollms-webui
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise through reading sensitive files like /etc/passwd, SSH keys, database credentials, or application configuration files, potentially leading to lateral movement and data exfiltration.
Likely Case
Unauthorized access to sensitive system and application files, credential theft, and potential privilege escalation depending on what files are accessible to the web server user.
If Mitigated
Limited impact with proper file permissions, web server sandboxing, and network segmentation preventing access to critical system files.
🎯 Exploit Status
Exploitation requires only a web browser or curl command with URL-encoded directory traversal sequences. The vulnerability is well-documented in public bug bounty reports.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Commit 49b0332e98d42dd5204dda53dee410b160106265
Vendor Advisory: https://github.com/parisneo/lollms-webui/commit/49b0332e98d42dd5204dda53dee410b160106265
Restart Required: Yes
Instructions:
1. Pull the latest lollms-webui repository. 2. Verify commit 49b0332e98d42dd5204dda53dee410b160106265 is present. 3. Restart the lollms-webui service. 4. Test that the vulnerability is no longer exploitable.
🔧 Temporary Workarounds
Web Server Path Restriction
allConfigure web server to block requests containing directory traversal sequences
# For nginx: add to server block
location ~ \.\./ { deny all; }
# For Apache: add to .htaccess
RewriteCond %{REQUEST_URI} \.\./ [NC]
RewriteRule .* - [F]
Network Access Control
allRestrict access to the lollms-webui interface to trusted IP addresses only
# For nginx:
allow 192.168.1.0/24;
deny all;
# For Apache:
Order deny,allow
Deny from all
Allow from 192.168.1.0/24
🧯 If You Can't Patch
- Implement strict file permissions to limit web server user access to sensitive files
- Deploy a Web Application Firewall (WAF) with LFI protection rules enabled
🔍 How to Verify
Check if Vulnerable:
Test with curl: curl -v 'http://target:port/personalities?path=../../../../etc/passwd' or URL-encoded equivalentCheck Version:
cd /path/to/lollms-webui && git log --oneline -1Verify Fix Applied:
Attempt the same exploit after patching - should return error or empty response instead of file contents📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /personalities containing ../ sequences
- Unusual file access patterns from web server process
- Failed attempts to access sensitive system files
Network Indicators:
- HTTP requests with URL-encoded directory traversal sequences (%2e%2e%2f)
- Multiple rapid requests to /personalities endpoint with varying paths
SIEM Query:
source="web_server_logs" AND uri_path="/personalities" AND (uri_query="*..*" OR uri_query="*%2e%2e*")🔗 References
- https://github.com/parisneo/lollms-webui/commit/49b0332e98d42dd5204dda53dee410b160106265
- https://huntr.com/bounties/29ec621a-bd69-4225-ab0f-5bb8a1d10c67
- https://github.com/parisneo/lollms-webui/commit/49b0332e98d42dd5204dda53dee410b160106265
- https://huntr.com/bounties/29ec621a-bd69-4225-ab0f-5bb8a1d10c67
