parisneo/lollmsにおけるパスサニタイズ不足によるLFI脆弱性

The impact of CVE-2024-4315 is significant, particularly on Windows systems. An attacker can exploit this LFI vulnerability to read sensitive configuration files, source code, or even system binaries. The ability to delete files could lead to denial-of-service conditions or further compromise the system. The vulnerability's exploitation path through personalities and /del_preset suggests a relatively straightforward attack vector, potentially accessible to less sophisticated attackers. Successful exploitation could grant an attacker complete control over the affected system, allowing for data exfiltration, privilege escalation, and persistent access.

Organizations running lollms version 9.5 or earlier, particularly those deploying the application on Windows servers, are at significant risk. Shared hosting environments where multiple users share the same lollms instance are also vulnerable, as an attacker could potentially exploit the vulnerability to access files belonging to other users.

• windows / supply-chain:

Get-ChildItem -Path "C:\path\to\lollms\personalities*" -Recurse -ErrorAction SilentlyContinue | Where-Object {$_.FullName -match '\\'} # Check for suspicious path patterns

• linux / server:

find /opt/lollms/personalities -type f -print0 | xargs -0 grep -i '\\'

• generic web:

curl -I http://your-lollms-server/personalities/../../../../etc/passwd # Attempt directory traversal

1. 2024-06-12Disclosure

   disclosure

1. 予約済み2024-04-29
2. 公開日2024-06-12
3. 更新日2025-10-15
4. EPSS 更新日2026-04-02

The primary mitigation for CVE-2024-4315 is to upgrade lollms to version 9.8 or later, which includes the necessary path sanitization fixes. If an immediate upgrade is not feasible, consider implementing stricter file access controls and limiting the permissions of the lollms user account. Monitor the personalities and /del_preset endpoints for suspicious activity. While a WAF might offer some protection, it's unlikely to be effective against this type of LFI vulnerability without specific rules tailored to the application's logic. After upgrading, verify the fix by attempting to access files outside the intended directories via the vulnerable endpoints to confirm that directory traversal is prevented.