CVE-2024-4315 (published 2024-06-12T01:15Z)

parisneo/lollms version 9.5 is vulnerable to Local File Inclusion (LFI) attacks due to insufficient path sanitization. The `sanitize_path_from_endpoint` function fails to properly sanitize Windows-style paths (backward slash `\\`), allowing attackers to perform directory traversal attacks on Windows systems. This vulnerability can be exploited through various routes, including `personalities` and `/del_preset`, to read or delete any file on the Windows filesystem, compromising the system's availability.


Weakness information:
cwe_id: CWE-98
cwe_name: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
description: The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.
extended_description: In certain versions and configurations of PHP, this can allow an attacker to specify a URL to a remote location from which the product will obtain the code to execute. In other cases in association with path traversal, the attacker can specify a local file that may contain executable statements that can be parsed by PHP.
         

Fix information:
repo_url: https://github.com/parisneo/lollms
commit_details: repo_url: https://github.com/parisneo/lollms
author: Saifeddine ALOUI
author_date: 2024-04-29 18:06:40+02:00
msg: updated security
repository: repo_url: https://github.com/parisneo/lollms
repo_name: ParisNeo/lollms
description: Lord of LLMS
repo_language: Python
owner: parisneo
file_changes: filename: security.py
change_type: ModificationType.MODIFY
diff: @@ -126,6 +126,9 @@ def sanitize_path(path: str, allow_absolute_path: bool = False, error_text="Abso
     if not allow_absolute_path and path.strip().startswith("/"):
         raise HTTPException(status_code=400, detail=exception_text)
 
+    # Normalize path to use forward slashes
+    path = path.replace('\\', '/')
+
     if path is None:
         return path
 
@@ -149,13 +152,14 @@ def sanitize_path(path: str, allow_absolute_path: bool = False, error_text="Abso
     
 def sanitize_path_from_endpoint(path: str, error_text: str = "A suspected LFI attack detected. The path sent to the server has suspicious elements in it!", exception_text: str = "Invalid path!") -> str:
     """
-    Sanitize a given file path from an endpoint by checking for potentially dangerous patterns and unauthorized characters.
+    Sanitize a given file path from an endpoint by checking for potentially dangerous patterns and unauthorized characters,
+    and standardizing path separators to prevent directory traversal attacks.
 
     Args:
     -----
     path (str): The file path to sanitize.
-    error_text (str, optional): The error message to display if a path traversal or unauthorized character is detected. Default is "A suspected LFI attack detected. The path sent to the server has suspicious elements in it!".
-    exception_text (str, optional): The exception message to display if an absolute path or invalid character is detected. Default is "Invalid path!".
+    error_text (str, optional): Error message to display if a path traversal or unauthorized character is detected. Default is a warning about a suspected LFI attack.
+    exception_text (str, optional): Exception message to display if an absolute path or invalid character is detected. Default is "Invalid path!".
 
     Raises:
     ------
@@ -164,15 +168,14 @@ def sanitize_path_from_endpoint(path: str, error_text: str = "A suspected LFI at
     Returns:
     -------
     str: The sanitized file path.
-
-    Note:
-    -----
-    This function checks for patterns like "...." and multiple forward slashes. It also checks for unauthorized punctuation characters, excluding the dot (.) character.
     """
 
     if path is None:
         return path
 
+    # Normalize path to use forward slashes
+    path = path.replace('\\', '/')
+
     if path.strip().startswith("/"):
         raise HTTPException(status_code=400, detail=exception_text)
 
@@ -185,13 +188,13 @@ def sanitize_path_from_endpoint(path: str, error_text: str = "A suspected LFI at
         raise HTTPException(status_code=400, detail=exception_text)
 
     if suspicious_patterns.search(path) or Path(path).is_absolute():
-        ASCIIColors.error(error_text)
-        raise HTTPException(status_code=400, detail=exception_text)
+        raise HTTPException(status_code=400, detail=error_text)
 
     path = path.lstrip('/')
     return path
 
 
+
 def forbid_remote_access(lollmsElfServer, exception_text = "This functionality is forbidden if the server is exposed"):
     if not lollmsElfServer.config.force_accept_remote_access and lollmsElfServer.config.host!="localhost" and lollmsElfServer.config.host!="127.0.0.1":
         raise Exception(exception_text)

programming_language: Python