Unauthorized Privilege Escalation in anything-llm Due to Mass Assignment Vulnerability

CVE-2024-3283

What is CVE-2024-3283?

The vulnerability in Anything-LLM created by Mintplex Labs allows users with manager roles to escalate their privileges to admin roles due to a mass assignment issue. The vulnerability is rooted in the '/admin/system-preferences' API endpoint, which improperly authorizes manager-level users to alter the 'multi_user_mode' system variable. This oversight enables those users to access the '/api/system/enable-multi-user' endpoint and create new admin user accounts. The lack of proper validation of modifiable fields in the JSON request body facilitates this unauthorized modification of system settings, posing significant security risks.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References