CVE-2024-8898
📋 TL;DR
A path traversal vulnerability in parisneo/lollms-webui version V12 allows attackers to create or delete arbitrary directories on the system by exploiting insufficient input sanitization in the install and uninstall API endpoints. This affects all users running the vulnerable version, potentially leading to system compromise.
💻 Affected Systems
- parisneo/lollms-webui
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise via directory manipulation leading to arbitrary file write/delete, privilege escalation, or service disruption.
Likely Case
Unauthorized directory creation/deletion leading to data loss, service disruption, or preparation for further attacks.
If Mitigated
Limited impact with proper input validation and directory restrictions in place.
🎯 Exploit Status
Exploitation requires API access but is straightforward once authenticated.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Fixed in commit 6d07c8a0dd0a15cc060becc73fda9fe8e788eb23
Vendor Advisory: https://github.com/parisneo/lollms-webui/commit/6d07c8a0dd0a15cc060becc73fda9fe8e788eb23
Restart Required: Yes
Instructions:
1. Update to the latest version after commit 6d07c8a0dd0a15cc060becc73fda9fe8e788eb23. 2. Restart the lollms-webui service. 3. Verify the fix by testing the API endpoints.
🔧 Temporary Workarounds
Disable vulnerable endpoints
allTemporarily disable the install and uninstall API endpoints if not needed.
Modify configuration to disable /api/install and /api/uninstall endpoints
Implement input validation
allAdd server-side input validation to restrict directory paths.
Implement path sanitization using libraries like pathlib or os.path.normpath
🧯 If You Can't Patch
- Restrict network access to the API endpoints using firewall rules.
- Implement strict file system permissions to limit directory creation/deletion capabilities.
🔍 How to Verify
Check if Vulnerable:
Check if running lollms-webui version V12 and test API endpoints with path traversal payloads.Check Version:
Check the version in the application interface or configuration files for 'V12'.Verify Fix Applied:
Verify the commit hash includes 6d07c8a0dd0a15cc060becc73fda9fe8e788eb23 and test that path traversal attempts are blocked.📡 Detection & Monitoring
Log Indicators:
- Unusual API calls to install/uninstall endpoints with suspicious paths
- Directory creation/deletion outside expected locations
Network Indicators:
- HTTP requests to /api/install or /api/uninstall with path traversal patterns
SIEM Query:
source="webui_logs" AND (uri="/api/install" OR uri="/api/uninstall") AND (path CONTAINS ".." OR path CONTAINS "/")