by Kastro
Paper/Archive/CVE-2024-0765

CVE-2024-0765

mintplex-labs mintplex-labs/anything-llm — Default user role exporting save state of instance

EPSS 0.6%CVSS 9.6
critical.is priorityof 100
38
CVSS 9.6 (CNA)9.6 / 10 × 3028.8Not in CISA KEV+300.0EPSS percentile 47.7.477 × 209.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

As a default user on a multi-user instance of AnythingLLM, you could execute a call to the `/export-data` endpoint of the system and then unzip and read that export that would enable you do exfiltrate data of the system at that save state. This would require the attacked to be granted explicit access to the system, but they can do this at any role. Additionally, post-download, the data is deleted so no evidence would exist that the exfiltration occured.

Affected

ProductAffectedFixed inSource
mintplex-labs/anything-llmunspecified – < 1.0.01.0.0CNA
anythingllm< 1.0.01.0.0CISA-ADP

Scores by source

@huntr_ai (CNA)9.6CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refhuntr.com/bounties/8978ab27-710c-44ce-bfd8-a2ea416dc786refgithub.com/mintplex-labs/anything-llm/commit/08d33cfd8fc47c5052b6ea29597c964a9da641e2