CVE-2024-3150 Privilege Escalation in mintplex-labs/anything-llm
Attackers with Default or Manager roles can escalate to Administrator by manipulating thread update requests, gaining full system control.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-3150?
CVE-2024-3150 is a high-severity vulnerability in Mintplexlabs Anythingllm, published on 6 Jun 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
In mintplex-labs/anything-llm, a vulnerability exists in the thread update process that allows users with Default or Manager roles to escalate their privileges to Administrator. The issue arises from improper input validation when handling HTTP POST requests to the endpoint `/workspace/:slug/thread/:threadSlug/update`. Specifically, the application fails to validate or check user input before passing it to the `workspace_thread` Prisma model for execution. This oversight allows attackers to craft a Prisma relation query operation that manipulates the `users` model to change a user's role to admin. Successful exploitation grants attackers the highest level of user privileges, enabling them to see and perform all actions within the system.
Weakness: CWE-755
Which versions are affected by CVE-2024-3150?
It affects 1 product.
Products include Mintplexlabs Anythingllm.
How do I fix CVE-2024-3150?
No fix has been published for CVE-2024-3150 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-3150 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-3150 exists.
Other vulnerabilities in Mintplexlabs Anythingllm
- CVE-2024-3025 Path Traversal in mintplex-labs/anything-llm
- CVE-2024-0455 SSRF on AWS deployed instances of AnythingLLM via /metadata
- CVE-2026-32626 AnythingLLM has a Streaming Phase XSS to RCE via LLM Response Injection
- CVE-2024-3104 Remote Code Execution in mintplex-labs/anything-llm
- CVE-2024-3149 SSRF in mintplex-labs/anything-llm
Sources
Also known as GHSA-x9m8-f37f-rw74.