MJ-bin

GitHub · Repository owner · Source ID 168641238
Source profile

Source-scoped identity with 1 associated PoC and 1 linked vulnerability.

Showing 1 PoC on this page

GitHub

MJ-bin/POC_CVE-2024-4322

Repository PoC0Created 2026-05-09ScannerCVE-2024-432217 files

306.6 KiB

GitHubPoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact provides Nuclei templates and Docker-based lab environments to validate detection of CVE-2024-4322, a path traversal vulnerability in LoLLMS WebUI. The primary code consists of YAML templates that send HTTP requests and match responses to identify vulnerable instances without exploiting the vulnerability for malicious purposes.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a README and two Nuclei templates for CVE-2024-4322. The README describes a Docker-based lab for reproducing a path traversal vulnerability and validating a detection template. The templates define HTTP requests and matchers to detect the vulnerability. No backdoor, deceptive payload, or concealed executable behavior is present in the reviewed text.

ClassificationScanner
Model confidence95%
AuthenticationNot required
LanguagesYAMLMarkdown
Target softwareLoLLMS WebUI
Attack typespath traversal
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact's primary stated purpose is to validate that Nuclei templates correctly detect the vulnerability. The README describes the lab as for 'validating that the associated Nuclei template does not match' patched versions. The YAML templates use matchers to check for vulnerability indicators but do not perform any action beyond detection, such as exfiltrating data or gaining access. This is consistent with a scanner.

README.md:3-5templates/CVE-2024-4322.yaml:1-67

Requirements

  • Target must be running a vulnerable version of LoLLMS WebUI (v9.6) with the /list_personalities endpoint exposed.README.md:4-5
  • Nuclei scanner must be installed to run the templates.README.md:249

Observed behavior

  • Sends a GET request to the root path to verify the target is LoLLMS WebUI by checking for 'LoLLMS WebUI - Welcome' in the response body.templates/CVE-2024-4322.yaml:35-47
  • Sends two GET requests to /list_personalities with category= and category=.. and matches responses to detect path traversal by checking for differences and the presence of 'personalities_zoo'.templates/CVE-2024-4322.yaml:49-67
  • An alternative template sends a single GET request with category=../.. and checks for 'lollms_core' and 'personal_data' in the response.templates/CVE-2024-4322_refined.yaml:48-58
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Url
Payload withheldExternal reference for downloading Nuclei, a legitimate security tool.README.md:260
Url
Payload withheldExternal repository URL used in lab setup to fetch legacy code.README.md:271
Review boundaries

What the analysis did not establish

  • The evidence packet reports complete_artifact_coverage as false, indicating that not all files from the repository are included. Only 3 of 17 files are provided as text, with 10 unclassified files and 4 non-text media files omitted. The analysis is based solely on the provided text files.
  • 14 files (including 4 non-text media files and 10 unclassified files) were omitted from the text evidence and not analyzed.
  • Binary content in the repository was flagged as metadata-only and not inspected.
  • The review covers only the supplied text; no dynamic analysis or execution was performed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.