PT-2024-23313 · Mintplex · Anything-Llm

Published 2024-04-15 · Updated 2025-07-09 · CVE-2024-3028

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions mintplex-labs/anything-llm (affected versions not specified)

Description The issue is due to improper input validation, allowing attackers to read and delete arbitrary files on the server. By manipulating the logo filename parameter in the "system-preferences" API endpoint, an attacker can construct requests to read sensitive files or the application's '.env' file, and even delete files by setting the logo filename to the path of the target file and invoking the "remove-logo" API endpoint. This is a result of the lack of proper sanitization of user-supplied input.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2024-3028

Affected Products

Anything-Llm

References · 7

• 🔥 https://huntr.com/bounties/41016b86-eabb-4161-ac81-40a1ca8e82ac · Exploit
• https://github.com/mintplex-labs/anything-llm/commit/7de23dbb2da932fbfb39f56d981784d3702cf5ce · Patch
• https://osv.dev/vulnerability/CVE-2024-3028 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-3028 · Security Note
• https://twitter.com/VulmonFeeds/status/1780117092508856567 · Twitter Post
• https://twitter.com/CVEnew/status/1780039221765660913 · Twitter Post
• https://t.me/cvenotify/128273 · Telegram Post