Mintplex-Labs Anything-LLM Vulnerable to Multiple Security Issues

CVE-2024-3152

What is CVE-2024-3152?

Mintplex Labs' Anything LLM is exposed to a series of vulnerabilities due to inadequate input validation across several critical endpoints, specifically affecting the /request-token, /workspace/:slug/thread/:threadSlug/update, /system/remove-logo, /system/logo, and the collector's /process endpoints. Attackers can exploit these vulnerabilities to escalate their privileges from default user roles to administrative roles, enabling unauthorized reading and deletion of files on the server. Additionally, the vulnerabilities may facilitate Server-Side Request Forgery (SSRF) attacks, which could compromise the internal infrastructure by allowing malicious requests to be sent from the server. The root cause lies in the application's failure to correctly validate user input before executing functions related to Prisma and other essential operations.

References