mintplex-labs anything-llm up to 0.x Setting system-preferences dynamically-determined object attributes

Summaryinfo

A vulnerability classified as critical has been found in mintplex-labs anything-llm up to 0.x. The impacted element is an unknown function of the file /admin/system-preferences of the component Setting Handler. This manipulation causes dynamically-determined object attributes. This vulnerability is registered as CVE-2024-3283. Remote exploitation of the attack is possible. No exploit is available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical was found in mintplex-labs anything-llm up to 0.x. Affected by this vulnerability is some unknown processing of the file /admin/system-preferences of the component Setting Handler. The manipulation with an unknown input leads to a dynamically-determined object attributes vulnerability. The CWE definition for the vulnerability is CWE-915. The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

A vulnerability in mintplex-labs/anything-llm allows users with manager roles to escalate their privileges to admin roles through a mass assignment issue. The '/admin/system-preferences' API endpoint improperly authorizes manager-level users to modify the 'multi_user_mode' system variable, enabling them to access the '/api/system/enable-multi-user' endpoint and create a new admin user. This issue results from the endpoint accepting a full JSON object in the request body without proper validation of modifiable fields, leading to unauthorized modification of system settings and subsequent privilege escalation.

The advisory is shared at huntr.com. This vulnerability is known as CVE-2024-3283 since 04/03/2024. The exploitation appears to be easy. The attack can be launched remotely. The exploitation requires an enhanced level of successful authentication. Technical details are known, but no exploit is available.

Upgrading to version 1.0.0 eliminates this vulnerability. Applying the patch 52fac844221a9b951d08ceb93c4c014e9397b1f2 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Artificial Intelligence Software

Vendor

• mintplex-labs

Name

• anything-llm

Version

• 0.x

License

• open-source

Website

• Product: https://github.com/mintplex-labs/anything-llm/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion