CVE-2024-3028
mintplex-labs/anything-llm is vulnerable to improper input validation, allowing attackers to read and delete arbitrary files on the server.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.83%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
mintplex-labs/anything-llm is vulnerable to improper input validation, allowing attackers to read and delete arbitrary files on the server. By manipulating the 'logo_filename' parameter in the 'system-preferences' API endpoint, an attacker can construct requests to read sensitive files or the application's '.env' file, and even delete files by setting the 'logo_filename' to the path of the target file and invoking the 'remove-logo' API endpoint. This vulnerability is due to the lack of proper sanitization of user-supplied input.
- CVSS 3.0
- 7.2 HIGHCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 0.83% probability · 56th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-20
- Affected
- mintplexlabs/anythingllm
- Source
- security@huntr.dev
References
- https://github.com/mintplex-labs/anything-llm/commit/7de23dbb2da932fbfb39f56d981784d3702cf5cePatch
- https://huntr.com/bounties/41016b86-eabb-4161-ac81-40a1ca8e82acExploit, Third Party Advisory
- https://github.com/mintplex-labs/anything-llm/commit/7de23dbb2da932fbfb39f56d981784d3702cf5cePatch
- https://huntr.com/bounties/41016b86-eabb-4161-ac81-40a1ca8e82acExploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.