CVE-2024-3569 Denial of Service (DoS) Vulnerability in mintplex-labs/anything-llm
Attackers can cause denial of service in AnythingLLM by sending crafted headers to a specific endpoint when running in password-protected 'just me' mode.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-3569?
CVE-2024-3569 is a high-severity denial of service vulnerability in Mintplexlabs Anythingllm, published on 10 Apr 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A Denial of Service (DoS) vulnerability exists in the mintplex-labs/anything-llm repository when the application is running in 'just me' mode with a password. An attacker can exploit this vulnerability by making a request to the endpoint using the [validatedRequest] middleware with a specially crafted 'Authorization:' header. This vulnerability leads to uncontrolled resource consumption, causing a DoS condition.
Weakness: CWE-400
Which versions are affected by CVE-2024-3569?
It affects 1 product.
Products include Mintplexlabs Anythingllm.
How do I fix CVE-2024-3569?
No fix has been published for CVE-2024-3569 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-3569 being exploited?
There is no known exploitation of CVE-2024-3569 in the wild and no public exploit code.
Other vulnerabilities in Mintplexlabs Anythingllm
- CVE-2024-3025 Path Traversal in mintplex-labs/anything-llm
- CVE-2024-0455 SSRF on AWS deployed instances of AnythingLLM via /metadata
- CVE-2026-32626 AnythingLLM has a Streaming Phase XSS to RCE via LLM Response Injection
- CVE-2024-3104 Remote Code Execution in mintplex-labs/anything-llm
- CVE-2024-3149 SSRF in mintplex-labs/anything-llm
Sources
Also known as GHSA-h9w4-3hv9-j8r3.