CVE-2024-3033 Improper Authorization in mintplex-labs/anything-llm
Unauthenticated attackers can delete VectorDB namespaces and list private workspace names in AnythingLLM, causing data loss and information disclosure.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-3033?
CVE-2024-3033 is a critical missing authorization vulnerability in Mintplexlabs Anythingllm, published on 6 Jun 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An improper authorization vulnerability exists in the mintplex-labs/anything-llm application, specifically within the '/api/v/' endpoint and its sub-routes. This flaw allows unauthenticated users to perform destructive actions on the VectorDB, including resetting the database and deleting specific namespaces, without requiring any authorization or permissions. The issue affects all versions up to and including the latest version, with a fix introduced in version 1.0.0. Exploitation of this vulnerability can lead to complete data loss of document embeddings across all workspaces, rendering workspace chats and embeddable chat widgets non-functional. Additionally, attackers can list all namespaces, potentially exposing private workspace names.
Weakness: CWE-863
Which versions are affected by CVE-2024-3033?
It affects 1 product.
Products include Mintplexlabs Anythingllm.
How do I fix CVE-2024-3033?
No fix has been published for CVE-2024-3033 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2024-3033 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-3033 exists.
Other vulnerabilities in Mintplexlabs Anythingllm
- CVE-2024-3025 Path Traversal in mintplex-labs/anything-llm
- CVE-2024-0455 SSRF on AWS deployed instances of AnythingLLM via /metadata
- CVE-2026-32626 AnythingLLM has a Streaming Phase XSS to RCE via LLM Response Injection
- CVE-2024-3104 Remote Code Execution in mintplex-labs/anything-llm
- CVE-2024-3149 SSRF in mintplex-labs/anything-llm
Sources
Also known as GHSA-pvhm-6x67-rvxq.