CVE-2024-4881 (published 2024-06-06T19:16Z)

A path traversal vulnerability exists in the parisneo/lollms application, affecting version 9.4.0 and potentially earlier versions, but fixed in version 5.9.0. The vulnerability arises due to improper validation of file paths between Windows and Linux environments, allowing attackers to traverse beyond the intended directory and read any file on the Windows system. Specifically, the application fails to adequately sanitize file paths containing backslashes (`\\`), which can be exploited to access the root directory and read, or even delete, sensitive files. This issue was discovered in the context of the `/user_infos` endpoint, where a crafted request using backslashes to reference a file (e.g., `\\windows\\win.ini`) could result in unauthorized file access. The impact of this vulnerability includes the potential for attackers to access sensitive information such as environment variables, database files, and configuration files, which could lead to further compromise of the system.


Weakness information:
cwe_id: CWE-36
cwe_name: Absolute Path Traversal
description: The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize absolute path sequences such as "/abs/path" that can resolve to a location that is outside of that directory.
extended_description: This allows attackers to traverse the file system to access files or directories that are outside of the restricted directory.
         

Fix information:
repo_url: https://github.com/parisneo/lollms
commit_details: repo_url: https://github.com/parisneo/lollms
author: Saifeddine ALOUI
author_date: 2024-04-29 18:06:40+02:00
msg: updated security
repository: repo_url: https://github.com/parisneo/lollms
repo_name: ParisNeo/lollms
description: Lord of LLMS
repo_language: Python
owner: parisneo
file_changes: filename: security.py
change_type: ModificationType.MODIFY
diff: @@ -126,6 +126,9 @@ def sanitize_path(path: str, allow_absolute_path: bool = False, error_text="Abso
     if not allow_absolute_path and path.strip().startswith("/"):
         raise HTTPException(status_code=400, detail=exception_text)
 
+    # Normalize path to use forward slashes
+    path = path.replace('\\', '/')
+
     if path is None:
         return path
 
@@ -149,13 +152,14 @@ def sanitize_path(path: str, allow_absolute_path: bool = False, error_text="Abso
     
 def sanitize_path_from_endpoint(path: str, error_text: str = "A suspected LFI attack detected. The path sent to the server has suspicious elements in it!", exception_text: str = "Invalid path!") -> str:
     """
-    Sanitize a given file path from an endpoint by checking for potentially dangerous patterns and unauthorized characters.
+    Sanitize a given file path from an endpoint by checking for potentially dangerous patterns and unauthorized characters,
+    and standardizing path separators to prevent directory traversal attacks.
 
     Args:
     -----
     path (str): The file path to sanitize.
-    error_text (str, optional): The error message to display if a path traversal or unauthorized character is detected. Default is "A suspected LFI attack detected. The path sent to the server has suspicious elements in it!".
-    exception_text (str, optional): The exception message to display if an absolute path or invalid character is detected. Default is "Invalid path!".
+    error_text (str, optional): Error message to display if a path traversal or unauthorized character is detected. Default is a warning about a suspected LFI attack.
+    exception_text (str, optional): Exception message to display if an absolute path or invalid character is detected. Default is "Invalid path!".
 
     Raises:
     ------
@@ -164,15 +168,14 @@ def sanitize_path_from_endpoint(path: str, error_text: str = "A suspected LFI at
     Returns:
     -------
     str: The sanitized file path.
-
-    Note:
-    -----
-    This function checks for patterns like "...." and multiple forward slashes. It also checks for unauthorized punctuation characters, excluding the dot (.) character.
     """
 
     if path is None:
         return path
 
+    # Normalize path to use forward slashes
+    path = path.replace('\\', '/')
+
     if path.strip().startswith("/"):
         raise HTTPException(status_code=400, detail=exception_text)
 
@@ -185,13 +188,13 @@ def sanitize_path_from_endpoint(path: str, error_text: str = "A suspected LFI at
         raise HTTPException(status_code=400, detail=exception_text)
 
     if suspicious_patterns.search(path) or Path(path).is_absolute():
-        ASCIIColors.error(error_text)
-        raise HTTPException(status_code=400, detail=exception_text)
+        raise HTTPException(status_code=400, detail=error_text)
 
     path = path.lstrip('/')
     return path
 
 
+
 def forbid_remote_access(lollmsElfServer, exception_text = "This functionality is forbidden if the server is exposed"):
     if not lollmsElfServer.config.force_accept_remote_access and lollmsElfServer.config.host!="localhost" and lollmsElfServer.config.host!="127.0.0.1":
         raise Exception(exception_text)

programming_language: Python