mintplex-labs anything-llm up to 1.3.0 Non-ASCII Filename path traversal

Summaryinfo

A vulnerability marked as critical has been reported in mintplex-labs anything-llm up to 1.3.0. The impacted element is an unknown function of the component Non-ASCII Filename Handler. This manipulation causes path traversal. The identification of this vulnerability is CVE-2024-13059. It is possible to initiate the attack remotely. There is no exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability has been found in mintplex-labs anything-llm up to 1.3.0 and classified as critical. Affected by this vulnerability is an unknown code of the component Non-ASCII Filename Handler. The manipulation with an unknown input leads to a path traversal vulnerability. The CWE definition for the vulnerability is CWE-29. The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '\..\filename' (leading backslash dot dot) sequences that can resolve to a location that is outside of that directory. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

A vulnerability in mintplex-labs/anything-llm prior to version 1.3.1 allows for path traversal due to improper handling of non-ASCII filenames in the multer library. This vulnerability can lead to arbitrary file write, which can subsequently result in remote code execution. The issue arises when the filename transformation introduces '../' sequences, which are not sanitized by multer, allowing attackers with manager or admin roles to write files to arbitrary locations on the server.

It is possible to read the advisory at huntr.com. This vulnerability is known as CVE-2024-13059 since 12/30/2024. The exploitation appears to be easy. The attack can be launched remotely. Additional levels of successful authentication are needed for exploitation. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1006 according to MITRE ATT&CK.

Upgrading to version 1.3.1 eliminates this vulnerability. Applying the patch 0b7bf68f2c02ca68075970fbf85d5a70ca5e94ca is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Artificial Intelligence Software

Vendor

• mintplex-labs

Name

• anything-llm

Version

• 1.0
• 1.1
• 1.2
• 1.3.0

License

• open-source

Website

• Product: https://github.com/mintplex-labs/anything-llm/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion