CVE-2024-1873

parisneo/lollms-webui is vulnerable to path traversal and denial of service attacks due to an exposed `/select_database` endpoint in version a9d16b0. The endpoint improperly handles file paths, allowing attackers to specify absolute paths when interacting with the `DiscussionsDB` instance. This flaw enables attackers to create directories anywhere on the system where the application has permissions, potentially leading to denial of service by creating directories with names of critical files, such as HTTPS certificate files, causing server startup failures. Additionally, attackers can manipulate the database path, resulting in the loss of client data by constantly changing the file location to an attacker-controlled location, scattering the data across the filesystem and making recovery difficult.

CVSS v3 8.2 HIGH

8.2^/10

CVSS v3 : HIGH

Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

Exploitability : 3.9 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://huntr.com/bounties/c1cfc0d9-517a-4d0e-bf1c-6444c1fd195d

Configurations

No configuration.

History

No history.

Information

Published : 2024-06-06 19:15

Updated : 2024-06-07 14:56

NVD link : CVE-2024-1873

Mitre link : CVE-2024-1873

CVE.ORG link : CVE-2024-1873

JSON object : View

Products Affected

No product.

CWE

CWE-749

Exposed Dangerous Method or Function

{"id": "CVE-2024-1873", "cveTags": [], "metrics": {"cvssMetricV30": [{"type": "Secondary", "source": "security@huntr.dev", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 4.2, "exploitabilityScore": 3.9}]}, "published": "2024-06-06T19:15:51.460", "references": [{"url": "https://huntr.com/bounties/c1cfc0d9-517a-4d0e-bf1c-6444c1fd195d", "source": "security@huntr.dev"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Primary", "source": "security@huntr.dev", "description": [{"lang": "en", "value": "CWE-749"}]}], "descriptions": [{"lang": "en", "value": "parisneo/lollms-webui is vulnerable to path traversal and denial of service attacks due to an exposed `/select_database` endpoint in version a9d16b0. The endpoint improperly handles file paths, allowing attackers to specify absolute paths when interacting with the `DiscussionsDB` instance. This flaw enables attackers to create directories anywhere on the system where the application has permissions, potentially leading to denial of service by creating directories with names of critical files, such as HTTPS certificate files, causing server startup failures. Additionally, attackers can manipulate the database path, resulting in the loss of client data by constantly changing the file location to an attacker-controlled location, scattering the data across the filesystem and making recovery difficult."}, {"lang": "es", "value": "parisneo/lollms-webui es vulnerable a ataques de path traversal y denegaci\u00f3n de servicio debido a un endpoint `/select_database` expuesto en la versi\u00f3n a9d16b0. El endpoint maneja incorrectamente las rutas de los archivos, lo que permite a los atacantes especificar rutas absolutas al interactuar con la instancia `DiscussionsDB`. Esta falla permite a los atacantes crear directorios en cualquier parte del sistema donde la aplicaci\u00f3n tenga permisos, lo que podr\u00eda provocar una denegaci\u00f3n de servicio al crear directorios con nombres de archivos cr\u00edticos, como archivos de certificados HTTPS, lo que provoca fallas en el inicio del servidor. Adem\u00e1s, los atacantes pueden manipular la ruta de la base de datos, lo que resulta en la p\u00e9rdida de datos del cliente al cambiar constantemente la ubicaci\u00f3n del archivo a una ubicaci\u00f3n controlada por el atacante, dispersando los datos por todo el sistema de archivos y dificultando la recuperaci\u00f3n."}], "lastModified": "2024-06-07T14:56:05.647", "sourceIdentifier": "security@huntr.dev"}