Mass Assignment Vulnerability in mintplex-labs/anything-llm Repository Allows Unauthorized Administrative Access

CVE-2024-0404

What is CVE-2024-0404?

The mass assignment vulnerability within the /api/invite/:code endpoint of Mintplex Labs' Anything LLM allows attackers to exploit the account creation process through an invitation link. By intercepting and altering the HTTP request, malicious users can inject a role property with an admin value, effortlessly obtaining administrative access to the system. This security flaw is a result of inadequate property allowlisting and blocklisting measures, which could lead to unauthorized actions under an admin account. Organizations using Anything LLM must take immediate action to address this vulnerability and ensure comprehensive security measures are in place.

References