PT-2024-24130 · Mintplex · Anything-Llm

Published

2024-06-06

·

Updated

2025-10-15

·

CVE-2024-3152

CVSS v3.1

8.8

High

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions mintplex-labs/anything-llm versions prior to 1.0.0
Description The issue is due to improper input validation in several endpoints, allowing an attacker to escalate privileges from a default user role to an admin role, read and delete arbitrary files on the system, and perform Server-Side Request Forgery (SSRF) attacks. The vulnerabilities are present in the "/request-token", "/workspace/:slug/thread/:threadSlug/update", "/system/remove-logo", "/system/logo", and collector's "/process" endpoints. These issues are due to the application's failure to properly validate user input before passing it to prisma functions and other critical operations.
Recommendations For versions prior to 1.0.0, update to version 1.0.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable endpoints, such as "/request-token", "/workspace/:slug/thread/:threadSlug/update", "/system/remove-logo", "/system/logo", and collector's "/process", until a patch is available. Additionally, ensure proper input validation is implemented for all user input to prevent exploitation.

Exploit

Fix

Improper Handling of Exceptional Conditions

SSRF

Weakness Enumeration

CWE-755CWE-918

Related Identifiers

CVE-2024-3152

Affected Products

Anything-Llm