PT-2024-23319 · Mintplex · Anything-Llm

Published 2024-06-06 · Updated 2024-11-03 · CVE-2024-3033

Positive Technologies (AI Summary)

CVSS v3.1

9.4

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

Name of the Vulnerable Software and Affected Versions mintplex-labs/anything-llm versions prior to 1.0.0

Description An improper authorization issue exists in the mintplex-labs/anything-llm application, specifically within the "/api/v/" endpoint and its sub-routes. This flaw allows unauthenticated users to perform destructive actions on the VectorDB, including resetting the database and deleting specific namespaces, without requiring any authorization or permissions. Exploitation of this issue can lead to complete data loss of document embeddings across all workspaces, rendering workspace chats and embeddable chat widgets non-functional. Additionally, attackers can list all namespaces, potentially exposing private workspace names.

Recommendations For versions prior to 1.0.0, update to version 1.0.0 to resolve the issue. As a temporary workaround, consider restricting access to the "/api/v/" endpoint and its sub-routes to prevent unauthenticated users from performing destructive actions on the VectorDB. Avoid using the vulnerable endpoint until the issue is resolved.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2024-3033

Affected Products

Anything-Llm

References · 8

• 🔥 https://huntr.com/bounties/8a98a0b4-7886-41c5-8624-fc5c21972e5a · Exploit
• https://github.com/mintplex-labs/anything-llm/commit/bf8df60c02b9ddc7ba682809ca12c5637606393a · Patch
• https://osv.dev/vulnerability/CVE-2024-3033 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-3033 · Security Note
• https://t.me/cvenotify/82308 · Telegram Post
• https://t.me/cvenotify/100416 · Telegram Post
• https://twitter.com/CveFindCom/status/1798777260625039790 · Twitter Post
• https://twitter.com/CVEnew/status/1798774600899416168 · Twitter Post