CVE-2024-3102
📋 TL;DR
A JSON injection vulnerability in the anything-llm application allows attackers to perform brute force attacks against the login system without knowing usernames. Once a password is known, attackers can conduct blind attacks to discover full usernames. This affects anyone running vulnerable versions of the anything-llm application.
💻 Affected Systems
- mintplex-labs/anything-llm
📦 What is this software?
Anythingllm by Mintplexlabs
⚠️ Risk & Real-World Impact
Worst Case
Attackers can enumerate valid usernames and potentially compromise user accounts, leading to unauthorized access to the LLM system and sensitive data.
Likely Case
Attackers can brute force usernames and potentially gain unauthorized access to user accounts, though password strength and rate limiting may limit impact.
If Mitigated
With proper input validation and rate limiting, the vulnerability would be reduced to a minor information disclosure issue.
🎯 Exploit Status
The vulnerability is publicly documented with proof-of-concept available, making exploitation straightforward for attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Commit 2374939ffb551ab2929d7f9d5827fe6597fa8caa or later
Vendor Advisory: https://github.com/mintplex-labs/anything-llm/commit/2374939ffb551ab2929d7f9d5827fe6597fa8caa
Restart Required: Yes
Instructions:
1. Update to the latest version of anything-llm. 2. Apply commit 2374939ffb551ab2929d7f9d5827fe6597fa8caa. 3. Restart the application service.
🔧 Temporary Workarounds
Implement Rate Limiting
allAdd rate limiting to the /api/request-token endpoint to prevent brute force attacks.
# Configure rate limiting in your reverse proxy or application firewall
Input Validation
allAdd strict input validation for the username parameter to reject malformed JSON.
# Implement server-side validation for username parameter
🧯 If You Can't Patch
- Implement network-level controls to restrict access to the /api/request-token endpoint
- Enable comprehensive logging and monitoring for suspicious authentication attempts
🔍 How to Verify
Check if Vulnerable:
Check if your anything-llm version is older than commit 2374939ffb551ab2929d7f9d5827fe6597fa8caaCheck Version:
git log --oneline -1Verify Fix Applied:
Verify that the application rejects malformed JSON in username parameter and implements proper input validation📡 Detection & Monitoring
Log Indicators:
- Multiple failed login attempts with malformed JSON in username field
- Unusual patterns of requests to /api/request-token
Network Indicators:
- High volume of POST requests to /api/request-token endpoint
- Requests containing JSON injection patterns in username parameter
SIEM Query:
source="application_logs" AND endpoint="/api/request-token" AND (username CONTAINS "{" OR username CONTAINS "}")🔗 References
- https://github.com/mintplex-labs/anything-llm/commit/2374939ffb551ab2929d7f9d5827fe6597fa8caa
- https://huntr.com/bounties/8af4650d-5955-44a4-86b4-d08e1c862b49
- https://github.com/mintplex-labs/anything-llm/commit/2374939ffb551ab2929d7f9d5827fe6597fa8caa
- https://huntr.com/bounties/8af4650d-5955-44a4-86b4-d08e1c862b49
