CVE-2024-5443

Source
https://nvd.nist.gov/vuln/detail/CVE-2024-5443
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-5443.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-5443
Aliases
Published
2024-06-22T17:15:34Z
Modified
2025-01-08T16:22:24.606654Z
Summary
[none]
Details

CVE-2024-4320 describes a vulnerability in the parisneo/lollms software, specifically within the ExtensionBuilder().build_extension() function. The vulnerability arises from the /mount_extension endpoint, where a path traversal issue allows attackers to navigate beyond the intended directory structure. This is facilitated by the data.category and data.folder parameters accepting empty strings (""), which, due to inadequate input sanitization, can lead to the construction of a package_path that points to the root directory. Consequently, if an attacker can create a config.yaml file in a controllable path, this path can be appended to the extensions list and trigger the execution of __init__.py in the current directory, leading to remote code execution. The vulnerability affects versions up to 5.9.0, and has been addressed in version 9.8.

References

Affected packages

Git / github.com/parisneo/lollms

Affected ranges

Type
GIT
Repo
https://github.com/parisneo/lollms
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
Fixed

Affected versions

v5.*

v5.9.0