CVE-2024-3279
📋 TL;DR
This vulnerability allows unauthenticated attackers to import malicious database files into the anything-llm application, potentially deleting or spoofing the legitimate database. This could lead to data loss, data manipulation, or serving malicious content to users. All deployments of anything-llm with the vulnerable version are affected.
💻 Affected Systems
- mintplex-labs/anything-llm
📦 What is this software?
Anythingllm by Mintplexlabs
⚠️ Risk & Real-World Impact
Worst Case
Complete database replacement with attacker-controlled data, leading to data destruction, credential theft, or persistent backdoor installation.
Likely Case
Database corruption or replacement with spoofed data, causing application disruption and potential data exposure.
If Mitigated
Unauthorized database imports are blocked, maintaining data integrity and preventing external manipulation.
🎯 Exploit Status
Exploit requires simple HTTP requests to the import endpoint without authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Commit 08d33cfd8fc47c5052b6ea29597c964a9da641e2 or later
Vendor Advisory: https://github.com/mintplex-labs/anything-llm/commit/08d33cfd8fc47c5052b6ea29597c964a9da641e2
Restart Required: Yes
Instructions:
1. Update to latest version from GitHub. 2. Restart the application. 3. Verify import endpoint requires authentication.
🔧 Temporary Workarounds
Network Access Restriction
linuxBlock external access to the import endpoint using firewall rules.
iptables -A INPUT -p tcp --dport [APP_PORT] -m string --string "/api/system/data-import" --algo bm -j DROP
Authentication Enforcement
allConfigure the application to require authentication for all endpoints.
🧯 If You Can't Patch
- Isolate the application behind a reverse proxy with authentication
- Implement network segmentation to restrict access to trusted sources only
🔍 How to Verify
Check if Vulnerable:
Attempt unauthenticated POST request to /api/system/data-import endpoint. If it accepts requests, system is vulnerable.Check Version:
Check git commit hash or version in application interfaceVerify Fix Applied:
Verify that unauthenticated requests to /api/system/data-import return 401/403 error.📡 Detection & Monitoring
Log Indicators:
- Unauthenticated POST requests to /api/system/data-import
- Database file modification timestamps
Network Indicators:
- HTTP POST to import endpoint without authentication headers
- Unusual database file transfers
SIEM Query:
source="web_logs" AND uri_path="/api/system/data-import" AND http_method="POST" AND NOT auth_token=*