PT-2024-15799 · Unknown · Anything-Llm

Published 2024-02-26 · Updated 2024-03-07 · CVE-2024-0759

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions AnythingLLM (affected versions not specified)

Description If an instance of AnythingLLM is hosted on an internal network and the attacker is granted a permission level of manager or admin, they could link-scrape internally to resolve IPs of other services on the same network. This would require the attacker to guess the internal IPs, as ranging is not possible, but it could be brute forced. Other services on the same network should not be fully open and accessible via a simple CuRL with zero authentication.

Recommendations As a temporary workaround, consider restricting access to the link collector until a patch is available. Avoid using the link collector to access other services on the same network until the issue is resolved. Restrict the permission level of users to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2024-0759

Affected Products

Anything-Llm

References · 7

• 🔥 https://huntr.com/bounties/9a978edd-ac94-41fc-8e3e-c35441bdd12b · Exploit
• https://github.com/mintplex-labs/anything-llm/commit/0db6c3b2aa1787a7054ffdaba975474f122c20eb · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-0759 · Security Note
• https://osv.dev/vulnerability/CVE-2024-0759 · Vendor Advisory
• https://t.me/cvenotify/72410 · Telegram Post
• https://t.me/cvenotify/73310 · Telegram Post
• https://twitter.com/CVEnew/status/1762349115412017444 · Twitter Post