Path Traversal und Denial of Service in parisneo/lollms-webui

The primary impact of CVE-2024-1873 is denial of service. An attacker can exploit this vulnerability by crafting malicious requests to the /select_database endpoint, specifying absolute paths to create directories. These directories can be named to mimic critical system files, such as those used for HTTPS certificates or other essential configuration files. By creating directories with these names, the attacker can prevent the lollms-webui application from starting correctly, effectively rendering the system unavailable. While the description doesn't explicitly mention data exfiltration, the ability to create arbitrary directories raises concerns about potential privilege escalation or further exploitation if the application runs with elevated permissions. The blast radius extends to any system running a vulnerable version of lollms-webui.

Organizations deploying lollms-webui in production environments, particularly those with lax file permission configurations or those running vulnerable versions (≤v9.3) are at risk. Shared hosting environments where multiple users share the same server instance are also particularly vulnerable, as an attacker could potentially exploit this vulnerability to impact other users on the same server.

• python / lollms-webui:

# Check for the vulnerable endpoint
curl -I http://<lollms-webui-ip>/select_database

• python / lollms-webui:

# Monitor for suspicious file creation attempts in lollms-webui logs
grep -i "/select_database" /var/log/lollms-webui.log

• generic web:

# Check for directory listing exposure
curl -I http://<lollms-webui-ip>/directory_listing

1. 2024-06-06Disclosure

   disclosure

1. Reserviert2024-02-24
2. Veröffentlicht2024-06-06
3. Geändert2025-10-15
4. EPSS aktualisiert2026-04-02

The recommended mitigation for CVE-2024-1873 is to immediately upgrade lollms-webui to version v9.3 or later, which contains the fix for this vulnerability. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) rule to block requests to the /selectdatabase endpoint or to sanitize user input to prevent path traversal attempts. Specifically, the WAF should be configured to reject requests containing absolute paths or paths with directory traversal sequences (e.g., ../). Regularly review and audit the application's file permissions to ensure that the lollms-webui process does not have unnecessary write access to sensitive system directories. After upgrading, confirm the fix by attempting to access the /selectdatabase endpoint with a crafted path traversal request; the request should be rejected.