{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:parisneo:lollms-webui:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "lollms-webui",
            "vendor": "parisneo",
            "versions": [
              {
                "status": "affected",
                "version": "*"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-2358",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-16T15:53:53.050024Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:29:16.821Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T19:11:53.476Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://huntr.com/bounties/b2771df3-be50-45bd-93c4-0974ce38bc22"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "parisneo/lollms-webui",
          "vendor": "parisneo",
          "versions": [
            {
              "lessThanOrEqual": "latest",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A path traversal vulnerability in the \u0027/apply_settings\u0027 endpoint of parisneo/lollms-webui allows attackers to execute arbitrary code. The vulnerability arises due to insufficient sanitization of user-supplied input in the configuration settings, specifically within the \u0027extensions\u0027 parameter. Attackers can exploit this by crafting a payload that includes relative path traversal sequences (\u0027../../../\u0027), enabling them to navigate to arbitrary directories. This flaw subsequently allows the server to load and execute a malicious \u0027__init__.py\u0027 file, leading to remote code execution. The issue affects the latest version of parisneo/lollms-webui."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-29",
              "description": "CWE-29 Path Traversal: \u0027\\..\\filename\u0027",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-05-16T09:03:45.397Z",
        "orgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
        "shortName": "@huntr_ai"
      },
      "references": [
        {
          "url": "https://huntr.com/bounties/b2771df3-be50-45bd-93c4-0974ce38bc22"
        }
      ],
      "source": {
        "advisory": "b2771df3-be50-45bd-93c4-0974ce38bc22",
        "discovery": "EXTERNAL"
      },
      "title": "Path Traversal leading to Remote Code Execution in parisneo/lollms-webui"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
    "assignerShortName": "@huntr_ai",
    "cveId": "CVE-2024-2358",
    "datePublished": "2024-05-16T09:03:45.397Z",
    "dateReserved": "2024-03-09T22:49:41.242Z",
    "dateUpdated": "2024-08-01T19:11:53.476Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-2358\",\"sourceIdentifier\":\"security@huntr.dev\",\"published\":\"2024-05-16T09:15:09.800\",\"lastModified\":\"2024-11-21T09:09:35.293\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A path traversal vulnerability in the \u0027/apply_settings\u0027 endpoint of parisneo/lollms-webui allows attackers to execute arbitrary code. The vulnerability arises due to insufficient sanitization of user-supplied input in the configuration settings, specifically within the \u0027extensions\u0027 parameter. Attackers can exploit this by crafting a payload that includes relative path traversal sequences (\u0027../../../\u0027), enabling them to navigate to arbitrary directories. This flaw subsequently allows the server to load and execute a malicious \u0027__init__.py\u0027 file, leading to remote code execution. The issue affects the latest version of parisneo/lollms-webui.\"},{\"lang\":\"es\",\"value\":\"Una vulnerabilidad de path traversal en el endpoint \u0027/apply_settings\u0027 de parisneo/lollms-webui permite a los atacantes ejecutar c\u00f3digo arbitrario. La vulnerabilidad surge debido a una desinfecci\u00f3n insuficiente de la entrada proporcionada por el usuario en los ajustes de configuraci\u00f3n, espec\u00edficamente dentro del par\u00e1metro \u0027extensions\u0027. Los atacantes pueden aprovechar esto manipulando un payload que incluya secuencias de path traversal relativo (\u0027../../../\u0027), lo que les permite navegar a directorios arbitrarios. Esta falla posteriormente permite que el servidor cargue y ejecute un archivo \u0027__init__.py\u0027 malicioso, lo que lleva a la ejecuci\u00f3n remota de c\u00f3digo. El problema afecta a la \u00faltima versi\u00f3n de parisneo/lollms-webui.\"}],\"metrics\":{\"cvssMetricV30\":[{\"source\":\"security@huntr.dev\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"security@huntr.dev\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-29\"}]}],\"references\":[{\"url\":\"https://huntr.com/bounties/b2771df3-be50-45bd-93c4-0974ce38bc22\",\"source\":\"security@huntr.dev\"},{\"url\":\"https://huntr.com/bounties/b2771df3-be50-45bd-93c4-0974ce38bc22\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}"
  }
}