CVE-2024-5824: lollms path traversal vulnerability allows overriding of config.yaml file, leading to RCE

June 27, 2024 (updated June 28, 2024)

A path traversal vulnerability in the /set_personality_config endpoint of parisneo/lollms version 9.4.0 allows an attacker to overwrite the configs/config.yaml file. This can lead to remote code execution by changing server configuration properties such as force_accept_remote_access and turn_on_code_validation.

References

github.com/advisories/GHSA-m45c-v46h-c788
github.com/parisneo/lollms
github.com/parisneo/lollms/commit/eda3af5f5c4ea9b2f3569f72f8d05989e29367fc
huntr.com/bounties/9ceb7cf9-a7cd-4699-b3f8-d0999d2b49fd
nvd.nist.gov/vuln/detail/CVE-2024-5824

Code Behaviors & Features

Detect and mitigate CVE-2024-5824 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →