Path Traversal in parisneo/lollms

The primary impact of CVE-2024-6085 is the ability for an attacker to read arbitrary files from the system. By manipulating the root folder setting to '/', an attacker can bypass existing protections and access files outside the intended scope. Furthermore, the vulnerability allows attackers to write audio files to arbitrary locations, potentially overwriting critical system files or creating malicious content. This could lead to data breaches, system instability, and unauthorized access.

Organizations deploying lollms for text-to-speech generation, particularly those running the XTTS server component, are at risk. Shared hosting environments where lollms is installed alongside other applications are especially vulnerable, as a successful exploit could potentially compromise the entire host.

• python / lollms:

import os
import requests

# Check for unusual file access attempts
with open('/var/log/lollms/xtts.log', 'r') as f:
    for line in f:
        if 'read_file' in line and '/etc/passwd' in line:
            print('Potential path traversal detected!')

• generic web:

curl -I http://<lollms_server>/xtts/settings/root_folder?root_folder=/

• generic web:

 grep -i 'root_folder=/' /var/log/apache2/access.log

1. 2024-06-27Disclosure

   disclosure

1. Reserviert2024-06-17
2. Veröffentlicht2024-06-27
3. Geändert2024-08-01
4. EPSS aktualisiert2026-04-02

The recommended mitigation for CVE-2024-6085 is to upgrade to a patched version of lollms as soon as it becomes available. Until a patch is available, consider implementing stricter access controls and input validation on the XTTS server. Employing a Web Application Firewall (WAF) with rules to prevent path traversal attempts can provide an additional layer of defense. Regularly monitor system logs for suspicious activity, particularly attempts to access files outside of expected directories.