PT-2024-35120 · Mintplex · Anything-Llm

Published 2024-06-19 · Updated 2025-10-15 · CVE-2024-5208

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions mintplex-labs/anything-llm (affected versions not specified)

Description An uncontrolled resource consumption issue exists in the "upload-link" endpoint, allowing attackers to cause a denial of service (DOS) by shutting down the server through sending invalid upload requests. This can be achieved by sending an empty body with a 'Content-Length: 0' header or by sending a body with arbitrary content, such as 'asdasdasd', with a 'Content-Length: 9' header. The issue is reproducible by users with at least a 'Manager' role, sending a crafted request to any workspace. This indicates that a previous fix was not effective in mitigating the issue.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Resource Exhaustion

Allocation of Resources Without Limits

Weakness Enumeration

CWE-400

CWE-770

Related Identifiers

CVE-2024-5208

Affected Products

Anything-Llm

References · 8

• 🔥 https://huntr.com/bounties/6c8bdfa1-ec56-4b02-bde9-cfc27470e6ca · Exploit
• https://github.com/mintplex-labs/anything-llm/commit/e2439c6d4c3cfdacd96cd1b7b92d1f89c3cc8459 · Patch
• https://osv.dev/vulnerability/CVE-2024-5208 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-5208 · Security Note
• https://t.me/cveNotify/138747 · Telegram Post
• https://t.me/cvenotify/83722 · Telegram Post
• https://t.me/cvenotify/128666 · Telegram Post
• https://twitter.com/aicyberinsights/status/1811136058601656782 · Twitter Post