CVE-2024-2362
📋 TL;DR
A path traversal vulnerability in parisneo/lollms-webui version 9.3 on Windows allows attackers to delete any file on the system by exploiting improper path validation in the 'del_preset' endpoint. This affects Windows users running the vulnerable version of the web UI. Attackers can use directory traversal sequences to access files outside intended directories.
💻 Affected Systems
- parisneo/lollms-webui
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise via deletion of critical system files, leading to OS corruption, data loss, or service disruption.
Likely Case
Unauthorized deletion of application files, configuration files, or user data, causing service disruption and potential data loss.
If Mitigated
Limited to deletion of files within the intended preset directory if proper input validation is implemented.
🎯 Exploit Status
Exploitation requires access to the 'del_preset' endpoint, which may require authentication depending on configuration.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 9.4 or later
Vendor Advisory: https://huntr.com/bounties/2433d0a4-9ba0-474b-be1a-6fd5019770ba
Restart Required: Yes
Instructions:
1. Update to version 9.4 or later. 2. Restart the lollms-webui service. 3. Verify the fix by testing the 'del_preset' endpoint with traversal attempts.
🔧 Temporary Workarounds
Input Validation Enhancement
allImplement server-side validation to reject absolute paths and directory traversal sequences in the 'del_preset' endpoint.
Modify the endpoint handler to sanitize input paths before processing.
Endpoint Restriction
allRestrict access to the 'del_preset' endpoint to trusted users or disable it if not needed.
Configure firewall rules or application-level access controls to limit endpoint access.
🧯 If You Can't Patch
- Implement network segmentation to isolate the lollms-webui instance from critical systems.
- Enable detailed logging for the 'del_preset' endpoint and monitor for suspicious deletion attempts.
🔍 How to Verify
Check if Vulnerable:
Check if running version 9.3 on Windows and test the 'del_preset' endpoint with a traversal payload (e.g., '../../windows/system32/testfile').Check Version:
Check the application version in the web UI interface or configuration files.Verify Fix Applied:
After updating, test the 'del_preset' endpoint with traversal payloads to ensure they are rejected.📡 Detection & Monitoring
Log Indicators:
- Log entries showing file deletion attempts with '..' sequences or absolute paths in the 'del_preset' endpoint.
Network Indicators:
- HTTP requests to the 'del_preset' endpoint containing path traversal sequences.
SIEM Query:
source="lollms-webui" AND endpoint="del_preset" AND (path="*..*" OR path="*:*")