CVE-2024-6842
published 2025-03-20CVE-2024-6842: In version 1.5.5 of mintplex-labs/anything-llm, the `/setup-complete` API endpoint allows unauthorized users to access sensitive system settings. The data…
PriorityP268high7.5CVSS 3.0
AVNACLPRNUINSUCHINAN
EXPLOIT
EPSS
29.19%
97.9th percentile
In version 1.5.5 of mintplex-labs/anything-llm, the `/setup-complete` API endpoint allows unauthorized users to access sensitive system settings. The data returned by the `currentSettings` function includes sensitive information such as API keys for search engines, which can be exploited by attackers to steal these keys and cause loss of user assets.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mintplex-labs | mintplex-labs_anything-llm | >= unspecified < 1.0.2 | 1.0.2 |
| mintplexlabs | anythingllm | — | — |
Detection & IOCsextracted from sources · hover to see the quote
otherResponse body keyword: "AgentGoogleSearchEngineId":
otherResponse body keyword: "AgentGoogleSearchEngineKey":
otherResponse body keyword: "AgentSerperApiKey":
otherResponse body keyword: "AgentBingSearchApiKey":
- →Detect unauthenticated HTTP GET requests to /api/setup-complete; a 200 response with JSON body containing 'AuthToken":true' and 'ApiKey":true' confirms exploitation of the information disclosure vulnerability.
- →Shodan query 'title:"AnythingLLM"' can be used to identify exposed AnythingLLM instances potentially vulnerable to this unauthenticated endpoint.
- →The vulnerability affects mintplex-labs/anything-llm version 1.5.5; the /setup-complete endpoint exposes the output of the currentSettings function to unauthenticated users.
- ·The Nuclei template matcher contains a likely typo: '- -"AgentGoogleSearchEngineKey":' has a leading dash before the quote, which may cause the word matcher to fail on that specific keyword. Validate the matcher before deploying.
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Nuclei
AnythingLLM - Information Disclosure
nuclei·CVSS 7.5
CVE-2024-6842 [HIGH] AnythingLLM - Information Disclosure
AnythingLLM - Information Disclosure
AnythingLLM suffers from an information disclosure vulnerability through the `/api/setup-complete` API endpoint. By accessing this endpoint, a remote and unauthenticated attacker can access sensitive configuration of the target AnythingLLM instance. This detection is included in the AI and LLM category.
Template:
id: CVE-2024-6842
info:
name: AnythingLLM - Information Disclosure
author: ingbunga,rahaaaiii,asteria121,breakpack,gy741
severity: high
description: |
AnythingLLM suffers from an information disclosure vulnerability through the `/api/setup-complete` API endpoint. By accessing this endpoint, a remote and unauthenticated attacker can access sensitive configuration of the target AnythingLLM instance. This detection is included in the AI and LL
No writeups or analysis indexed.
2025-03-20
Published