by Kastro
Paper/Archive/CVE-2024-0550

CVE-2024-0550

mintplex-labs mintplex-labs/anything-llm — Privileged User using traversal to read system files

EPSS 0.7%public exploitCVSS 9.6
critical.is priorityof 100
50
CVSS 9.6 (CNA)9.6 / 10 × 3028.8Not in CISA KEV+300.0EPSS percentile 53.8.538 × 2010.8Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

A user who is privileged already `manager` or `admin` can set their profile picture via the frontend API using a relative filepath to then user the PFP GET API to download any valid files. The attacker would have to have been granted privileged permissions to the system before executing this attack.

Affected

ProductAffectedFixed inSource
mintplex-labs/anything-llmunspecified – < 1.0.01.0.0CNA
anythingllm< 1.0.01.0.0CISA-ADP

Scores by source

@huntr_ai (CNA)9.6CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: partial

References

refhuntr.com/bounties/c6afeb5e-f211-4b3d-aa4b-6bad734217a6refgithub.com/mintplex-labs/anything-llm/commit/e1dcd5ded010b03abd6aa32d1bf0668a48e38e17