Mintplex-Labs Anything-Llm vulnerabilities

CVE-2024-6842 [HIGH] CWE-306 CVE-2024-6842: In version 1.5.5 of mintplex-labs/anything-llm, the `/setup-complete` API endpoint allows unauthoriz In version 1.5.5 of mintplex-labs/anything-llm, the `/setup-complete` API endpoint allows unauthorized users to access sensitive system settings. The data returned by the `currentSettings` function includes sensitive information such as API keys for search engines, which can be exploited by attackers to steal these keys and cause loss of user assets.

CVE-2024-3025 [CRITICAL] CWE-23 CVE-2024-3025: mintplex-labs/anything-llm is vulnerable to path traversal attacks due to insufficient validation of mintplex-labs/anything-llm is vulnerable to path traversal attacks due to insufficient validation of user-supplied input in the logo filename functionality. Attackers can exploit this vulnerability by manipulating the logo filename to reference files outside of the restricted directory. This can lead to unauthorized reading or deletion of files by ut

CVE-2024-13059 [HIGH] CWE-29 CVE-2024-13059: A vulnerability in mintplex-labs/anything-llm prior to version 1.3.1 allows for path traversal due t A vulnerability in mintplex-labs/anything-llm prior to version 1.3.1 allows for path traversal due to improper handling of non-ASCII filenames in the multer library. This vulnerability can lead to arbitrary file write, which can subsequently result in remote code execution. The issue arises when the filename transformation introduces '../' sequences, w

CVE-2024-3104 [CRITICAL] CWE-78 CVE-2024-3104: A remote code execution vulnerability exists in mintplex-labs/anything-llm due to improper handling A remote code execution vulnerability exists in mintplex-labs/anything-llm due to improper handling of environment variables. Attackers can exploit this vulnerability by injecting arbitrary environment variables via the `POST /api/system/update-env` endpoint, which allows for the execution of arbitrary code on the host running anything-llm. The vulner

CVE-2024-8196 [CRITICAL] CWE-306 CVE-2024-8196: In mintplex-labs/anything-llm v1.5.11 desktop version for Windows, the application opens server port In mintplex-labs/anything-llm v1.5.11 desktop version for Windows, the application opens server port 3001 on 0.0.0.0 with no authentication by default. This vulnerability allows an attacker to gain full backend access, enabling them to perform actions such as deleting all data from the workspace.

CVE-2024-0404 [CRITICAL] CWE-915 CVE-2024-0404: A mass assignment vulnerability exists in the `/api/invite/:code` endpoint of the mintplex-labs/anyt A mass assignment vulnerability exists in the `/api/invite/:code` endpoint of the mintplex-labs/anything-llm repository, allowing unauthorized creation of high-privileged accounts. By intercepting and modifying the HTTP request during the account creation process via an invitation link, an attacker can add a `role` property with `admin` value, there

CVE-2024-3152 [HIGH] CWE-918 CVE-2024-3152: mintplex-labs/anything-llm is vulnerable to multiple security issues due to improper input validatio mintplex-labs/anything-llm is vulnerable to multiple security issues due to improper input validation in several endpoints. An attacker can exploit these vulnerabilities to escalate privileges from a default user role to an admin role, read and delete arbitrary files on the system, and perform Server-Side Request Forgery (SSRF) attacks. The vulnerabilit

CVE-2024-3033 [CRITICAL] CWE-863 CVE-2024-3033: An improper authorization vulnerability exists in the mintplex-labs/anything-llm application, specif An improper authorization vulnerability exists in the mintplex-labs/anything-llm application, specifically within the '/api/v/' endpoint and its sub-routes. This flaw allows unauthenticated users to perform destructive actions on the VectorDB, including resetting the database and deleting specific namespaces, without requiring any authorization or p

CVE-2024-3150 [HIGH] CWE-755 CVE-2024-3150: In mintplex-labs/anything-llm, a vulnerability exists in the thread update process that allows users In mintplex-labs/anything-llm, a vulnerability exists in the thread update process that allows users with Default or Manager roles to escalate their privileges to Administrator. The issue arises from improper input validation when handling HTTP POST requests to the endpoint `/workspace/:slug/thread/:threadSlug/update`. Specifically, the application fail

CVE-2024-3149 [HIGH] CWE-918 CVE-2024-3149: A Server-Side Request Forgery (SSRF) vulnerability exists in the upload link feature of mintplex-lab A Server-Side Request Forgery (SSRF) vulnerability exists in the upload link feature of mintplex-labs/anything-llm. This feature, intended for users with manager or admin roles, processes uploaded links through an internal Collector API using a headless browser. An attacker can exploit this by hosting a malicious website and using it to perform actions

CVE-2024-3279 [CRITICAL] CWE-306 CVE-2024-3279: An improper access control vulnerability exists in the mintplex-labs/anything-llm application, speci An improper access control vulnerability exists in the mintplex-labs/anything-llm application, specifically within the import endpoint. This vulnerability allows an anonymous attacker, without an account in the application, to import their own database file, leading to the deletion or spoofing of the existing `anythingllm.db` file. By exploiting thi

CVE-2024-0763 [HIGH] CWE-22 CVE-2024-0763: Any user can delete an arbitrary folder (recursively) on a remote server due to bad input sanitizati Any user can delete an arbitrary folder (recursively) on a remote server due to bad input sanitization leading to path traversal. The attacker would need access to the server at some privilege level since this endpoint is protected and requires authorization.

CVE-2024-0439 [HIGH] CWE-269 CVE-2024-0439: As a manager, you should not be able to modify a series of settings. In the UI this is indeed hidden As a manager, you should not be able to modify a series of settings. In the UI this is indeed hidden as a convenience for the role since most managers would not be savvy enough to modify these settings. They can use their token to still modify those settings though through a standard HTTP request While this is not a critical vulnerability, it does inde

CVE-2023-4899 [HIGH] CWE-89 CVE-2023-4899: SQL Injection in GitHub repository mintplex-labs/anything-llm prior to 0.0.1. SQL Injection in GitHub repository mintplex-labs/anything-llm prior to 0.0.1.

CVE-2024-0549 [HIGH] CWE-23 CVE-2024-0549: mintplex-labs/anything-llm is vulnerable to a relative path traversal attack, allowing unauthorized mintplex-labs/anything-llm is vulnerable to a relative path traversal attack, allowing unauthorized attackers with a default role account to delete files and folders within the filesystem, including critical database files such as 'anythingllm.db'. The vulnerability stems from insufficient input validation and normalization in the handling of file and fol

CVE-2024-4084 [HIGH] CWE-918 CVE-2024-4084: A Server-Side Request Forgery (SSRF) vulnerability exists in the latest version of mintplex-labs/any A Server-Side Request Forgery (SSRF) vulnerability exists in the latest version of mintplex-labs/anything-llm, allowing attackers to bypass the official fix intended to restrict access to intranet IP addresses and protocols. Despite efforts to filter out intranet IP addresses starting with 192, 172, 10, and 127 through regular expressions and limit acce

CVE-2024-3166 [CRITICAL] CWE-79 CVE-2024-3166: A Cross-Site Scripting (XSS) vulnerability exists in mintplex-labs/anything-llm, affecting both the A Cross-Site Scripting (XSS) vulnerability exists in mintplex-labs/anything-llm, affecting both the desktop application version 1.2.0 and the latest version of the web application. The vulnerability arises from the application's feature to fetch and embed content from websites into workspaces, which can be exploited to execute arbitrary JavaScript cod

CVE-2023-5833 [HIGH] CWE-284 CVE-2023-5833: Improper Access Control in GitHub repository mintplex-labs/anything-llm prior to 0.1.0. Improper Access Control in GitHub repository mintplex-labs/anything-llm prior to 0.1.0.

CVE-2024-10109 [HIGH] CWE-863 CVE-2024-10109: A vulnerability in the mintplex-labs/anything-llm repository, as of commit 5c40419, allows low privi A vulnerability in the mintplex-labs/anything-llm repository, as of commit 5c40419, allows low privilege users to access the sensitive API endpoint "/api/system/custom-models". This access enables them to modify the model's API key and base path, leading to potential API key leakage and denial of service on chats.

CVE-2024-10513 [HIGH] CWE-23 CVE-2024-10513: A path traversal vulnerability exists in the 'document uploads manager' feature of mintplex-labs/any A path traversal vulnerability exists in the 'document uploads manager' feature of mintplex-labs/anything-llm, affecting the latest version prior to 1.2.2. This vulnerability allows users with the 'manager' role to access and manipulate the 'anythingllm.db' database file. By exploiting the vulnerable endpoint '/api/document/move-files', an attacker can