CVE-2023-4897
📋 TL;DR
This vulnerability allows attackers to perform relative path traversal attacks in the Anything-LLM software, enabling unauthorized access to files outside the intended directory. It affects all users running versions prior to 0.0.1 of the mintplex-labs/anything-llm repository.
💻 Affected Systems
- mintplex-labs/anything-llm
📦 What is this software?
Anythingllm by Mintplexlabs
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through arbitrary file read/write, potentially leading to sensitive data exposure, code execution, or system takeover.
Likely Case
Unauthorized access to sensitive configuration files, user data, or system files stored on the server.
If Mitigated
Limited impact with proper file system permissions and access controls in place, potentially only exposing non-critical files.
🎯 Exploit Status
Path traversal vulnerabilities are well-understood and easily exploitable with basic HTTP requests.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.0.1 and later
Vendor Advisory: https://github.com/mintplex-labs/anything-llm/commit/3c88aec034934bcbad30c5ef1cab62cbbdb98e64
Restart Required: Yes
Instructions:
1. Update to version 0.0.1 or later. 2. Pull the latest code from the repository. 3. Restart the application service.
🔧 Temporary Workarounds
Input Validation Filter
allImplement server-side validation to reject requests containing path traversal sequences like '../'
File System Sandboxing
linuxRun the application with restricted file system permissions using chroot or containerization
docker run --read-only -v /safe/path:/app/data your-image
🧯 If You Can't Patch
- Implement a web application firewall (WAF) with path traversal protection rules
- Isolate the application server from sensitive file systems using network segmentation
🔍 How to Verify
Check if Vulnerable:
Check if running version is earlier than 0.0.1 by examining package.json or application version endpointCheck Version:
grep '"version"' package.jsonVerify Fix Applied:
Confirm version is 0.0.1 or later and test path traversal attempts return proper error responses📡 Detection & Monitoring
Log Indicators:
- HTTP requests containing '../' sequences
- Access to unexpected file paths in application logs
Network Indicators:
- HTTP requests with encoded path traversal patterns (%2e%2e%2f)
SIEM Query:
source="web_logs" AND (uri="*../*" OR uri="*%2e%2e%2f*")🔗 References
- https://github.com/mintplex-labs/anything-llm/commit/3c88aec034934bcbad30c5ef1cab62cbbdb98e64
- https://huntr.dev/bounties/0631af48-84a3-4019-85db-f0f8b12cb0ab
- https://github.com/mintplex-labs/anything-llm/commit/3c88aec034934bcbad30c5ef1cab62cbbdb98e64
- https://huntr.dev/bounties/0631af48-84a3-4019-85db-f0f8b12cb0ab
