CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
Percentile
9.1%
CVE-2024-4320 describes a vulnerability in the parisneo/lollms software, specifically within the ExtensionBuilder().build_extension()
function. The vulnerability arises from the /mount_extension
endpoint, where a path traversal issue allows attackers to navigate beyond the intended directory structure. This is facilitated by the data.category
and data.folder
parameters accepting empty strings (""
), which, due to inadequate input sanitization, can lead to the construction of a package_path
that points to the root directory. Consequently, if an attacker can create a config.yaml
file in a controllable path, this path can be appended to the extensions
list and trigger the execution of __init__.py
in the current directory, leading to remote code execution. The vulnerability affects versions up to 5.9.0, and has been addressed in version 9.8.
[
{
"vendor": "parisneo",
"product": "parisneo/lollms",
"versions": [
{
"version": "unspecified",
"lessThan": "9.8",
"status": "affected",
"versionType": "custom"
}
]
}
]