mintplex-labs anything-llm up to 0.0.x Setting privileges management

Summaryinfo

A vulnerability described as critical has been identified in mintplex-labs anything-llm up to 0.0.x. Affected by this issue is some unknown functionality of the component Setting Handler. Executing a manipulation can lead to privileges management. This vulnerability appears as CVE-2024-0439. The attack may be performed from remote. There is no available exploit. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability classified as critical was found in mintplex-labs anything-llm up to 0.0.x. This vulnerability affects an unknown code block of the component Setting Handler. The manipulation with an unknown input leads to a privileges management vulnerability. The CWE definition for the vulnerability is CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. As an impact it is known to affect integrity. CVE summarizes:

As a manager, you should not be able to modify a series of settings. In the UI this is indeed hidden as a convenience for the role since most managers would not be savvy enough to modify these settings. They can use their token to still modify those settings though through a standard HTTP request While this is not a critical vulnerability, it does indeed need to be patched to enforce the expected permission level.

The weakness was presented 02/26/2024 as 7200a06ef07d92eef5f3c4c8be29824aa001d688. The advisory is shared for download at github.com. This vulnerability was named CVE-2024-0439 since 01/11/2024. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1068.

Upgrading to version 1.0.0 eliminates this vulnerability. Applying the patch 7200a06ef07d92eef5f3c4c8be29824aa001d688 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Artificial Intelligence Software

Vendor

• mintplex-labs

Name

• anything-llm

Version

• 0.0

License

• open-source

Website

• Product: https://github.com/mintplex-labs/anything-llm/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion