Mass Assignment Vulnerability in mintplex-labs/anything-llm Repository Allows Unauthorized Administrative Access

CVE-2024-0404

What is CVE-2024-0404?

The mass assignment vulnerability within the /api/invite/:code endpoint of Mintplex Labs' Anything LLM allows attackers to exploit the account creation process through an invitation link. By intercepting and altering the HTTP request, malicious users can inject a role property with an admin value, effortlessly obtaining administrative access to the system. This security flaw is a result of inadequate property allowlisting and blocklisting measures, which could lead to unauthorized actions under an admin account. Organizations using Anything LLM must take immediate action to address this vulnerability and ensure comprehensive security measures are in place.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References