Improper Input Validation in mintplex-labs/anything-llm

CVE-2024-3029

What is CVE-2024-3029?

In the Mintplex Labs Anything-LLM application, a serious vulnerability arises due to improper input validation on the '/system/enable-multi-user' endpoint. An attacker can exploit this flaw by sending a specially crafted malformed JSON payload, which triggers an error. The resulting catch block inadvertently deletes all existing user accounts and disables the multi-user feature. This exploitation allows an attacker to not only remove users but also create a new admin user without requiring a password, ultimately leading to unauthorized access and administrative control over the application.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References