Unauthorized Privilege Escalation in anything-llm Due to Mass Assignment Vulnerability

CVE-2024-3283

What is CVE-2024-3283?

The vulnerability in Anything-LLM created by Mintplex Labs allows users with manager roles to escalate their privileges to admin roles due to a mass assignment issue. The vulnerability is rooted in the '/admin/system-preferences' API endpoint, which improperly authorizes manager-level users to alter the 'multi_user_mode' system variable. This oversight enables those users to access the '/api/system/enable-multi-user' endpoint and create new admin user accounts. The lack of proper validation of modifiable fields in the JSON request body facilitates this unauthorized modification of system settings, posing significant security risks.

References