Unauthorized Access to VectorDB: Complete Data Loss Possible

CVE-2024-3033

What is CVE-2024-3033?

An improper authorization vulnerability exists in the mintplex-labs Anything-LLM application specifically within the '/api/v/' endpoint and its sub-routes. This vulnerability enables unauthenticated users to execute destructive actions on the VectorDB, such as resetting the database and deleting certain namespaces, without needing any form of authorization or permissions. The flaw affects all versions of the application up to and including the latest release. Exploiting this issue can lead to extensive data loss of document embeddings across all workspaces, thereby disabling workspace chats and embeddable chat widgets. Additionally, attackers have the capability to list all namespaces, potentially exposing private workspace names.

References