CVE-2024-6394
📋 TL;DR
A Local File Inclusion vulnerability in parisneo/lollms-webui allows attackers to read arbitrary files on the server through path traversal. This affects all users running versions below v9.8, potentially exposing sensitive server files.
💻 Affected Systems
- parisneo/lollms-webui
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise through exposure of SSH keys, database credentials, and configuration files leading to lateral movement.
Likely Case
Exfiltration of sensitive configuration files, source code, and potentially credentials stored on the server.
If Mitigated
Limited impact with proper file permissions and network segmentation preventing access to critical files.
🎯 Exploit Status
Simple path traversal attack requiring only web access to the vulnerable endpoint
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v9.8 and above
Vendor Advisory: https://huntr.com/bounties/6df4f990-b632-4791-b3ea-f40c9ea905bf
Restart Required: Yes
Instructions:
1. Backup current installation. 2. Update to v9.8 or later via git pull or fresh install. 3. Restart the lollms-webui service.
🔧 Temporary Workarounds
Input Validation Filter
linuxAdd path validation to block directory traversal sequences
sed -i "s|path = request.args.get('path')|path = os.path.normpath(request.args.get('path')).lstrip('/')|g" app.py
Web Application Firewall
allBlock requests containing path traversal patterns
🧯 If You Can't Patch
- Restrict file system permissions to minimum required for lollms-webui user
- Implement network segmentation to isolate vulnerable instances from sensitive systems
🔍 How to Verify
Check if Vulnerable:
Check if version is below 9.8 and test for LFI via /js?path=../../../etc/passwdCheck Version:
grep -i version lollms-webui/__init__.py || check git tagVerify Fix Applied:
Confirm version is 9.8+ and test that path traversal attempts return 404 or sanitized paths📡 Detection & Monitoring
Log Indicators:
- Multiple 404 errors for non-existent JS files
- Requests with ../ patterns in path parameter
Network Indicators:
- Unusual file read patterns from web server
- Requests to /js endpoint with traversal sequences
SIEM Query:
source="web_logs" AND (uri_path="/js" AND query="*../*")