CVE-2024-3149 SSRF in mintplex-labs/anything-llm

Critical 9.6 Published 6 Jun 2024 Updated 1 Aug 2024

Attackers with manager roles can exploit SSRF in the upload link feature to scan internal ports, access internal services, and delete files or read logs.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2024-3149?

CVE-2024-3149 is a critical server-side request forgery vulnerability in Mintplexlabs Anythingllm, published on 6 Jun 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A Server-Side Request Forgery (SSRF) vulnerability exists in the upload link feature of mintplex-labs/anything-llm. This feature, intended for users with manager or admin roles, processes uploaded links through an internal Collector API using a headless browser. An attacker can exploit this by hosting a malicious website and using it to perform actions such as internal port scanning, accessing internal web applications not exposed externally, and interacting with the Collector API. This interaction can lead to unauthorized actions such as arbitrary file deletion and limited Local File Inclusion (LFI), including accessing NGINX access logs which may contain sensitive information.

Weakness: CWE-918

Which versions are affected by CVE-2024-3149?

It affects 1 product.

Products include Mintplexlabs Anythingllm.

How do I fix CVE-2024-3149?

No fix has been published for CVE-2024-3149 yet. Limit exposure of the affected software until one is available.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2024-3149 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-3149 exists.

All Mintplexlabs Anythingllm vulnerabilities

Sources

Also known as GHSA-wrr2-6xwv-w627.