CVE-2024-4841

published 2024-06-23

CVE-2024-4841: A Path Traversal vulnerability exists in the parisneo/lollms-webui, specifically within the 'add_reference_to_local_mode' function due to the lack of input…

Priority P2 69 low 3.3 CVSS 3.1

AV L AC L PR L UI N S U C L I N A N

ITW EXPLOIT VulnCheck KEV

A Path Traversal vulnerability exists in the parisneo/lollms-webui, specifically within the 'add_reference_to_local_mode' function due to the lack of input sanitization. This vulnerability affects versions v9.6 to the latest. By exploiting this vulnerability, an attacker can predict the folders, subfolders, and files present on the victim's computer. The vulnerability is present in the way the application handles the 'path' parameter in HTTP requests to the '/add_reference_to_local_model' endpoint.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
lollms	lollms-webui	—	—
parisneo	parisneo_lollms-webui	unspecified – latest	—

Detection & IOCs extracted from sources · hover to see the quote

url /add_reference_to_local_model↗

command POST /add_reference_to_local_model HTTP/1.1 Content-Type: application/json {"path":"\\Users"}↗

• → Detect path traversal attempts targeting the '/add_reference_to_local_model' POST endpoint; look for JSON body with a 'path' parameter containing backslash-prefixed directory traversal strings (e.g., '\\Users', '\\..\\'). ↗
• → Use the FOFA fingerprint 'LoLLMS WebUI - Welcome' to identify exposed instances of the vulnerable application on the internet. ↗

• · The vulnerability affects parisneo/lollms-webui versions v9.6 to the latest at time of disclosure; scope detection rules accordingly. ↗
• · The path traversal is exploitable without authentication (PR:N, UI:N per CVSS), meaning no session or login token is required to probe the endpoint. ↗

CVSS provenance

nvd v3.1 3.3 LOW CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

nvd v3.0 4.0 MEDIUM CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vulncheck 3.3 LOW

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-29