PT-2024-23314 · Mintplex · Anything-Llm

Published 2024-04-15 · Updated 2025-07-09 · CVE-2024-3029

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions mintplex-labs/anything-llm (affected versions not specified)

Description The issue arises from improper input validation. An attacker can exploit this by sending a malformed JSON payload to the "/system/enable-multi-user" endpoint, triggering an error. This error is caught by a catch block, which then deletes all users and disables the 'multi user mode'. As a result, an attacker can remove all existing users and potentially create a new admin user without requiring a password, leading to unauthorized access and control over the application.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2024-3029

Affected Products

Anything-Llm

References · 7

• 🔥 https://huntr.com/bounties/7189a7a0-9830-459d-b853-bdc2559999a0 · Exploit
• https://github.com/mintplex-labs/anything-llm/commit/99cfee1e7025fe9a0919a4d506ba1e1b819f6073 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-3029 · Security Note
• https://osv.dev/vulnerability/CVE-2024-3029 · Vendor Advisory
• https://twitter.com/CVEnew/status/1780039207387644357 · Twitter Post
• https://t.me/cvenotify/128274 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1780119880525619235 · Twitter Post