Path Traversal to Arbitrary File Read/Delete/Overwrite, DoS Attack, and Admin Account Takeover in mintplex-labs/anything-llm

CVE-2024-5211

What is CVE-2024-5211?

A path traversal vulnerability in Anything-LLM by Mintplex Labs exists due to improper validation of user input during the custom logo setup process. This flaw allows managers to bypass the normalizePath() function, leading to unauthorized access to sensitive files, including the 'anythingllm.db' database and files within the 'storage' directory. The exploitation of this vulnerability can result in reading, deleting, or overwriting critical application files, endangering internal keys and configuration secrets. Additionally, attackers can orchestrate denial of service (DoS) attacks by deleting essential files required for the application's functionality, which could compromise the integrity and availability of the service.

References