PT-2024-15574 · Unknown · Anything-Llm

Published 2024-02-25 · Updated 2024-02-26 · CVE-2024-0455

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions AnythingLLM (affected versions not specified)

Description The issue allows users with proper authorization levels (manager, admin, and when in single user mode) to access sensitive information by using a web scraper to query a specific URL: "http://169.254.169.254/latest/meta-data/identity-credentials/ec2/security-credentials/ec2-instance". This URL is only resolvable from within an EC2 instance and could reveal connection and secret credentials for the instance, enabling unauthorized management. The exploit requires pre-existing knowledge of the hosting infrastructure and specific conditions such as improperly configured iptables or firewall rules.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2024-0455

Affected Products

Anything-Llm

References · 5

• 🔥 https://huntr.com/bounties/07d83b49-7ebb-40d2-83fc-78381e3c5c9c · Exploit
• https://github.com/mintplex-labs/anything-llm/commit/b2b2c2afe15c48952d57b4d01e7108f9515c5f55 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-0455 · Security Note
• https://osv.dev/vulnerability/CVE-2024-0455 · Vendor Advisory
• https://twitter.com/CVEnew/status/1761671971853463758 · Twitter Post