text-generation-webui Path Traversal Vulnerability Allows Arbitrary File Reading
Overview
The text-generation-webui application, a popular open-source interface for interacting with Large Language Models, suffers from a critical unauthenticated path traversal vulnerability. This flaw exists in the `load_prompt()` function within versions prior to 4.3. An attacker can exploit this by crafting a malicious request that manipulates the file path parameter, enabling them to traverse directories and access any arbitrary .txt file present on the server's filesystem. The contents of the targeted file are then directly returned within the API response, posing a significant risk of sensitive data exfiltration. This could include configuration files, source code, or other confidential information, depending on the server's setup and file permissions. The vulnerability is particularly concerning as it does not require any form of authentication, making it accessible to unauthenticated users.
Affected Systems
Testing Guide
1. Ensure you have a vulnerable version of text-generation-webui installed. 2. Send a crafted HTTP request to the `/api/v1/prompt/load` endpoint (or the relevant endpoint for loading prompts) with a manipulated `filename` parameter designed to traverse directories, for example: `?filename=../../../../etc/passwd` or `?filename=../../../../windows/win.ini`. 3. Analyze the API response. If the content of the accessed file is returned, the system is vulnerable.
Mitigation Steps
1. **Update text-generation-webui:** Upgrade to version 4.3 or later immediately. 2. **Input Validation:** If updating is not feasible, implement strict input validation on all user-supplied file path parameters within the `load_prompt()` function to prevent directory traversal sequences (e.g., `../`). 3. **File Access Restrictions:** Configure file system permissions to limit the read access of the web server process to only necessary directories and files. 4. **Web Application Firewall (WAF):** Deploy a WAF and configure rules to detect and block requests containing common path traversal patterns.
Patch Details
Version 4.3