CVE-2024-3322
📋 TL;DR
This path traversal vulnerability in the lollms-webui's codeguard personality allows attackers to read and overwrite arbitrary files on the system by manipulating the 'code_folder_path' parameter. Attackers can access sensitive files outside intended directories using '../' sequences or absolute paths. All users running affected versions of lollms-webui with the cyber_security/codeguard personality enabled are vulnerable.
💻 Affected Systems
- parisneo/lollms-webui
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through reading sensitive files (passwords, SSH keys, configuration files) and overwriting critical system files or application code to establish persistence.
Likely Case
Unauthorized access to sensitive application data, configuration files, and user data stored on the same server, potentially leading to data theft or service disruption.
If Mitigated
Limited impact if proper file system permissions restrict the web application user, though sensitive application data remains at risk.
🎯 Exploit Status
The vulnerability is straightforward to exploit with basic HTTP requests manipulating the path parameter. No authentication is required to access the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Fixed in commit 1e17df01e01d4d33599db2afaafe91d90b6f0189 and later versions
Vendor Advisory: https://github.com/parisneo/lollms-webui/commit/1e17df01e01d4d33599db2afaafe91d90b6f0189
Restart Required: Yes
Instructions:
1. Update lollms-webui to version after commit 1e17df01e01d4d33599db2afaafe91d90b6f0189. 2. Restart the webui service. 3. Verify the fix by checking that the processor.py file includes proper path sanitization.
🔧 Temporary Workarounds
Disable codeguard personality
allTemporarily disable the vulnerable cyber_security/codeguard personality until patching is complete.
Edit lollms-webui configuration to remove or disable the codeguard personality
Restrict webui user permissions
linuxRun the lollms-webui service under a restricted user with minimal file system access.
sudo chown -R restricted_user:restricted_user /path/to/lollms-webui
sudo -u restricted_user python app.py
🧯 If You Can't Patch
- Disable the cyber_security/codeguard personality entirely in the webui configuration.
- Implement strict network access controls to limit who can access the lollms-webui interface.
🔍 How to Verify
Check if Vulnerable:
Check if your lollms-webui version is 9.5 or earlier and the cyber_security/codeguard personality is enabled. Examine processor.py for lack of path sanitization.Check Version:
Check the lollms-webui version in the application interface or review the git commit history.Verify Fix Applied:
Verify the processor.py file includes proper path validation and sanitization, particularly checking for '../' sequences and absolute path restrictions.📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns in webui logs
- Requests containing '../' sequences in path parameters
- Failed file access attempts outside expected directories
Network Indicators:
- HTTP requests to the codeguard endpoint with unusual path parameters
- Multiple rapid requests attempting different path traversals
SIEM Query:
web.url: *codeguard* AND (web.uri: *../* OR web.uri: */etc/* OR web.uri: */home/*)🔗 References
- https://github.com/parisneo/lollms-webui/commit/1e17df01e01d4d33599db2afaafe91d90b6f0189
- https://huntr.com/bounties/e0822362-033a-4a71-b1dc-d803f03bd427
- https://github.com/parisneo/lollms-webui/commit/1e17df01e01d4d33599db2afaafe91d90b6f0189
- https://huntr.com/bounties/e0822362-033a-4a71-b1dc-d803f03bd427
