CVE-2024-5208
📋 TL;DR
An uncontrolled resource consumption vulnerability in the 'upload-link' endpoint of mintplex-labs/anything-llm allows authenticated users with Manager role or higher to cause denial of service by sending specially crafted upload requests. Attackers can shut down the server by sending empty or malformed requests with specific Content-Length headers. This affects all deployments of anything-llm with vulnerable versions.
💻 Affected Systems
- mintplex-labs/anything-llm
📦 What is this software?
Anythingllm by Mintplexlabs
⚠️ Risk & Real-World Impact
Worst Case
Complete server shutdown leading to sustained denial of service, disrupting all LLM services and potentially causing data loss if unsaved work is affected.
Likely Case
Temporary service disruption requiring manual server restart, impacting productivity and availability of the anything-llm application.
If Mitigated
Minimal impact with proper authentication controls and rate limiting, though authenticated users could still cause temporary disruptions.
🎯 Exploit Status
Exploitation details are publicly documented in bounty reports. Attack requires authenticated access with Manager privileges but uses simple HTTP requests.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Commit e2439c6d4c3cfdacd96cd1b7b92d1f89c3cc8459 and later
Vendor Advisory: https://github.com/mintplex-labs/anything-llm/commit/e2439c6d4c3cfdacd96cd1b7b92d1f89c3cc8459
Restart Required: Yes
Instructions:
1. Update to latest anything-llm version. 2. Apply commit e2439c6d4c3cfdacd96cd1b7b92d1f89c3cc8459. 3. Restart the anything-llm service. 4. Verify the fix by testing the upload-link endpoint.
🔧 Temporary Workarounds
Disable upload-link endpoint
allTemporarily disable or restrict access to the vulnerable upload-link endpoint
# Configure web server (nginx/apache) to block /api/upload-link
# Or modify application routing to disable the endpoint
Implement rate limiting
linuxAdd rate limiting to the upload-link endpoint to prevent abuse
# Using nginx: limit_req_zone $binary_remote_addr zone=uploadlimit:10m rate=1r/s;
# Then apply to location block for upload-link
🧯 If You Can't Patch
- Restrict Manager role access to trusted users only
- Implement network-level controls to monitor and block suspicious upload-link requests
🔍 How to Verify
Check if Vulnerable:
Send a POST request to /api/upload-link with Content-Length: 0 header and empty body using Manager credentials. If server crashes or becomes unresponsive, it's vulnerable.Check Version:
Check git log for commit e2439c6d4c3cfdacd96cd1b7b92d1f89c3cc8459 or check package.json version if availableVerify Fix Applied:
After patching, repeat the test request. Server should return proper error response (400 Bad Request) instead of crashing.📡 Detection & Monitoring
Log Indicators:
- Multiple failed upload attempts from same user
- Server crash logs following upload-link requests
- Error logs showing malformed upload requests
Network Indicators:
- High volume of POST requests to /api/upload-link
- Requests with Content-Length: 0 or small arbitrary content
- Rapid sequence of upload requests from single source
SIEM Query:
source="web_logs" AND (url_path="/api/upload-link" AND (content_length="0" OR status_code="400")) | stats count by src_ip user_agent🔗 References
- https://github.com/mintplex-labs/anything-llm/commit/e2439c6d4c3cfdacd96cd1b7b92d1f89c3cc8459
- https://huntr.com/bounties/6c8bdfa1-ec56-4b02-bde9-cfc27470e6ca
- https://github.com/mintplex-labs/anything-llm/commit/e2439c6d4c3cfdacd96cd1b7b92d1f89c3cc8459
- https://huntr.com/bounties/6c8bdfa1-ec56-4b02-bde9-cfc27470e6ca
