PT-2024-30188 · Unknown · Anything-Llm

Published 2024-05-20 · Updated 2025-07-10 · CVE-2024-4287

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions anything-llm (affected versions not specified)

Description A vulnerability exists in the workspace update process due to improper input validation. The application fails to validate or format JSON data sent in an HTTP POST request to "/api/workspace/:workspace-slug/update", allowing it to be executed as part of a database query without restrictions. This enables users with a manager role to craft a request that includes nested write operations, effectively allowing them to create new Administrator accounts.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2024-4287

Affected Products

Anything-Llm

References · 7

• 🔥 https://huntr.com/bounties/34491fb7-5133-4e80-8782-74124350bbdb · Exploit
• https://github.com/mintplex-labs/anything-llm/commit/94b58249a37a21b1c08deaa2d1edfdecbb6deb18 · Patch
• https://osv.dev/vulnerability/CVE-2024-4287 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-4287 · Security Note
• https://t.me/cvenotify/80447 · Telegram Post
• https://t.me/cvenotify/128383 · Telegram Post
• https://t.me/cvenotify/80439 · Telegram Post