CVE-2024-3028 Improper Input Validation in mintplex-labs/anything-llm

High 7.2 Published 16 Apr 2024 Updated 6 Sep 2024

Attackers can read or delete arbitrary server files via path traversal in the logo_filename parameter of the system-preferences API.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2024-3028?

CVE-2024-3028 is a high-severity path traversal vulnerability in Mintplexlabs Anythingllm, published on 16 Apr 2024. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

mintplex-labs/anything-llm is vulnerable to improper input validation, allowing attackers to read and delete arbitrary files on the server. By manipulating the 'logo_filename' parameter in the 'system-preferences' API endpoint, an attacker can construct requests to read sensitive files or the application's '.env' file, and even delete files by setting the 'logo_filename' to the path of the target file and invoking the 'remove-logo' API endpoint. This vulnerability is due to the lack of proper sanitization of user-supplied input.

Weakness: CWE-20

Which versions are affected by CVE-2024-3028?

It affects 1 product.

Products include Mintplexlabs Anythingllm.

How do I fix CVE-2024-3028?

No fix has been published for CVE-2024-3028 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2024-3028 being exploited?

There is no known exploitation of CVE-2024-3028 in the wild and no public exploit code.

All Mintplexlabs Anythingllm vulnerabilities

Sources

Also known as GHSA-jq5m-3v7c-39qm.