CVE-2024-0795
📋 TL;DR
This vulnerability allows attackers with admin or manager roles in Anything LLM to create new admin users without proper backend authentication, enabling privilege escalation. It affects instances where users already have elevated access. The flaw stems from improper access control (CWE-284).
💻 Affected Systems
- Anything LLM
📦 What is this software?
Anythingllm by Mintplexlabs
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the Anything LLM instance, allowing attackers to create persistent admin accounts, access sensitive data, and potentially pivot to other systems.
Likely Case
Unauthorized privilege escalation where existing admin/manager users can create additional admin accounts, bypassing intended access controls.
If Mitigated
Minimal impact if proper role-based access controls and authentication checks are implemented.
🎯 Exploit Status
Exploitation requires existing admin/manager credentials but is straightforward once access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Commit 9a237db3d1f66cdbcf5079599258f5fb251c5564 and later
Vendor Advisory: https://github.com/mintplex-labs/anything-llm/commit/9a237db3d1f66cdbcf5079599258f5fb251c5564
Restart Required: Yes
Instructions:
1. Update Anything LLM to latest version. 2. Apply commit 9a237db3d1f66cdbcf5079599258f5fb251c5564. 3. Restart the application.
🔧 Temporary Workarounds
Restrict Admin Access
allLimit admin/manager role assignments to only essential personnel and monitor for suspicious account creation.
Implement Additional Authentication Layer
allAdd multi-factor authentication or additional verification for user creation actions.
🧯 If You Can't Patch
- Implement strict monitoring of user creation events and admin account activities.
- Regularly audit admin accounts and remove unnecessary elevated privileges.
🔍 How to Verify
Check if Vulnerable:
Check if your Anything LLM version is before commit 9a237db3d1f66cdbcf5079599258f5fb251c5564.Check Version:
git log --oneline -1Verify Fix Applied:
Verify the commit hash includes 9a237db3d1f66cdbcf5079599258f5fb251c5564 and test that admin users cannot create new admin accounts without proper backend authentication.📡 Detection & Monitoring
Log Indicators:
- Unexpected admin user creation events
- Multiple admin accounts created in short time
Network Indicators:
- Unusual API calls to user creation endpoints from admin accounts
SIEM Query:
source="anything-llm" AND event="user_created" AND role="admin"🔗 References
- https://github.com/mintplex-labs/anything-llm/commit/9a237db3d1f66cdbcf5079599258f5fb251c5564
- https://huntr.com/bounties/f69e3307-7b44-4776-ac60-2990990723ec
- https://github.com/mintplex-labs/anything-llm/commit/9a237db3d1f66cdbcf5079599258f5fb251c5564
- https://huntr.com/bounties/f69e3307-7b44-4776-ac60-2990990723ec
