mintplex-labs anything-llm up to 0.x system-preferences API Endpoint logo_filename input validation

Summaryinfo

A vulnerability labeled as problematic has been found in mintplex-labs anything-llm up to 0.x. This issue affects some unknown processing of the component system-preferences API Endpoint. Such manipulation of the argument logo_filename leads to input validation. This vulnerability is listed as CVE-2024-3028. The attack may be performed from remote. There is no available exploit. The affected component should be upgraded.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in mintplex-labs anything-llm up to 0.x. Affected by this issue is an unknown part of the component system-preferences API Endpoint. The manipulation of the argument logo_filename with an unknown input leads to a input validation vulnerability. Using CWE to declare the problem leads to CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. Impacted is confidentiality, integrity, and availability. CVE summarizes:

mintplex-labs/anything-llm is vulnerable to improper input validation, allowing attackers to read and delete arbitrary files on the server. By manipulating the 'logo_filename' parameter in the 'system-preferences' API endpoint, an attacker can construct requests to read sensitive files or the application's '.env' file, and even delete files by setting the 'logo_filename' to the path of the target file and invoking the 'remove-logo' API endpoint. This vulnerability is due to the lack of proper sanitization of user-supplied input.

The advisory is available at huntr.com. This vulnerability is handled as CVE-2024-3028 since 03/27/2024. The exploitation is known to be easy. The attack may be launched remotely. Additional levels of successful authentication are necessary for exploitation. Technical details are known, but there is no available exploit.

Upgrading to version 1.0.0 eliminates this vulnerability. Applying the patch 7de23dbb2da932fbfb39f56d981784d3702cf5ce is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Artificial Intelligence Software

Vendor

• mintplex-labs

Name

• anything-llm

Version

• 0.x

License

• open-source

Website

• Product: https://github.com/mintplex-labs/anything-llm/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion