PT-2024-19413 · Unknown · Anything-Llm

Nnfrog

·

Published

2024-01-18

·

Updated

2024-01-25

·

CVE-2024-22422

CVSS v3.1

7.5

High

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions AnythingLLM versions prior to commit 08d33cfd8
Description AnythingLLM is an application that turns any document, resource, or piece of content into context that any LLM can use as references during chatting. In versions prior to commit 08d33cfd8, an unauthenticated API route (file export) can allow an attacker to crash the server, resulting in a denial of service attack. The "data-export" endpoint is used to export files using the filename parameter as user input. The endpoint takes the user input, filters it to avoid directory traversal attacks, fetches the file from the server, and afterwards deletes it. An attacker can trick the input filter mechanism to point to the current directory, and while attempting to delete it, the server will crash as there is no error-handling wrapper around it. Moreover, the endpoint is public and does not require any form of authentication, resulting in an unauthenticated Denial of Service issue, which crashes the instance using a single HTTP packet.
Recommendations For AnythingLLM versions prior to commit 08d33cfd8, users are advised to upgrade to a version that includes the fix, as committed in 08d33cfd8. As a temporary workaround, consider disabling the "data-export" endpoint until a patch is available. Restrict access to the endpoint to minimize the risk of exploitation. Avoid using the filename parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

Improper Check for Exceptional Conditions

Weakness Enumeration

CWE-754

Related Identifiers

CVE-2024-22422
GHSA-XMJ6-G32R-FC5Q

Affected Products

Anything-Llm