CVE-2024-3101
📋 TL;DR
This vulnerability in mintplex-labs/anything-llm allows attackers to disable Multi-User Mode via improper input validation, enabling them to create new admin accounts without passwords and gain unauthorized administrative access. All users running vulnerable versions of anything-llm are affected.
💻 Affected Systems
- mintplex-labs/anything-llm
📦 What is this software?
Anythingllm by Mintplexlabs
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with administrative access, allowing data theft, system manipulation, and further privilege escalation.
Likely Case
Unauthorized administrative access leading to data exposure, configuration changes, and potential lateral movement within the system.
If Mitigated
Limited impact with proper network segmentation and access controls, though administrative functions could still be compromised.
🎯 Exploit Status
Simple curl command with specific parameter can trigger the vulnerability as described in references.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Commit 52fac844221a9b951d08ceb93c4c014e9397b1f2 and later
Vendor Advisory: https://github.com/mintplex-labs/anything-llm/commit/52fac844221a9b951d08ceb93c4c014e9397b1f2
Restart Required: Yes
Instructions:
1. Update to latest version or apply commit 52fac844221a9b951d08ceb93c4c014e9397b1f2. 2. Restart the anything-llm service. 3. Verify Multi-User Mode cannot be disabled via unauthorized requests.
🔧 Temporary Workarounds
Network Access Restriction
linuxRestrict network access to anything-llm instance to trusted IPs only
iptables -A INPUT -p tcp --dport <anything-llm-port> -s <trusted-ip> -j ACCEPT
iptables -A INPUT -p tcp --dport <anything-llm-port> -j DROP
Reverse Proxy Validation
allConfigure reverse proxy to block requests containing 'multi_user_mode' parameter
# nginx example: location / { if ($args ~* "multi_user_mode") { return 403; } }
🧯 If You Can't Patch
- Isolate the anything-llm instance from untrusted networks using firewall rules
- Implement strict authentication and authorization controls at network perimeter
🔍 How to Verify
Check if Vulnerable:
Check if current version is before commit 52fac844221a9b951d08ceb93c4c014e9397b1f2 by examining git history or version metadataCheck Version:
git log --oneline -1Verify Fix Applied:
Attempt to send curl request with 'multi_user_mode=false' parameter and verify it fails or requires proper authentication📡 Detection & Monitoring
Log Indicators:
- HTTP requests containing 'multi_user_mode' parameter
- Unauthorized admin user creation events
- Multi-User Mode disablement logs
Network Indicators:
- HTTP POST/PUT requests with 'multi_user_mode=false' parameter
- Unusual admin account creation traffic
SIEM Query:
http.method IN ("POST", "PUT") AND http.uri_params CONTAINS "multi_user_mode"🔗 References
- https://github.com/mintplex-labs/anything-llm/commit/52fac844221a9b951d08ceb93c4c014e9397b1f2
- https://huntr.com/bounties/c114c03e-3348-450f-88f7-538502047bcc
- https://github.com/mintplex-labs/anything-llm/commit/52fac844221a9b951d08ceb93c4c014e9397b1f2
- https://huntr.com/bounties/c114c03e-3348-450f-88f7-538502047bcc
