CVE-2024-2913 Race Condition Vulnerability in mintplex-labs/anything-llm
Attackers can create multiple unauthorized user accounts from a single invite link by exploiting a race condition in the acceptance process.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-2913?
CVE-2024-2913 is a medium-severity vulnerability in Mintplexlabs Anythingllm, published on 6 May 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A race condition vulnerability exists in the mintplex-labs/anything-llm repository, specifically within the user invite acceptance process. Attackers can exploit this vulnerability by sending multiple concurrent requests to accept a single user invite, allowing the creation of multiple user accounts from a single invite link intended for only one user. This bypasses the intended security mechanism that restricts invite acceptance to a single user, leading to unauthorized user creation without detection in the invite tab. The issue is due to the lack of validation for concurrent requests in the backend.
Weakness: CWE-367
Which versions are affected by CVE-2024-2913?
It affects 1 product.
Products include Mintplexlabs Anythingllm.
How do I fix CVE-2024-2913?
No fix has been published for CVE-2024-2913 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-2913 being exploited?
There is no known exploitation of CVE-2024-2913 in the wild and no public exploit code.
Other vulnerabilities in Mintplexlabs Anythingllm
- CVE-2024-3025 Path Traversal in mintplex-labs/anything-llm
- CVE-2024-0455 SSRF on AWS deployed instances of AnythingLLM via /metadata
- CVE-2026-32626 AnythingLLM has a Streaming Phase XSS to RCE via LLM Response Injection
- CVE-2024-3104 Remote Code Execution in mintplex-labs/anything-llm
- CVE-2024-3149 SSRF in mintplex-labs/anything-llm
Sources
Also known as GHSA-h4fj-pp9j-x2mj.