CVE-2024-5213 Exposure of Sensitive Information in mintplex-labs/anything-llm
Attackers can obtain bcrypt password hashes from API responses, potentially aiding offline cracking attacks against user accounts.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-5213?
CVE-2024-5213 is a medium-severity vulnerability in Mintplexlabs Anythingllm, published on 20 Jun 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
In mintplex-labs/anything-llm versions up to and including 1.5.3, an issue was discovered where the password hash of a user is returned in the response after login (`POST /api/request-token`) and after account creations (`POST /api/admin/users/new`). This exposure occurs because the entire User object, including the bcrypt password hash, is included in the response sent to the frontend. This practice could potentially lead to sensitive information exposure despite the use of bcrypt, a strong hashing algorithm. It is recommended not to expose any clues about passwords to the frontend.
Weakness: CWE-201
Which versions are affected by CVE-2024-5213?
It affects 1 product.
Products include Mintplexlabs Anythingllm.
How do I fix CVE-2024-5213?
No fix has been published for CVE-2024-5213 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-5213 being exploited?
There is no known exploitation of CVE-2024-5213 in the wild and no public exploit code.
Other vulnerabilities in Mintplexlabs Anythingllm
- CVE-2024-3025 Path Traversal in mintplex-labs/anything-llm
- CVE-2024-0455 SSRF on AWS deployed instances of AnythingLLM via /metadata
- CVE-2026-32626 AnythingLLM has a Streaming Phase XSS to RCE via LLM Response Injection
- CVE-2024-3104 Remote Code Execution in mintplex-labs/anything-llm
- CVE-2024-3149 SSRF in mintplex-labs/anything-llm
Sources
Also known as GHSA-c72r-fww5-rpch.