CVE-2024-8249
📋 TL;DR
This vulnerability allows unauthenticated attackers to crash the Anything-LLM server by sending malformed JSON payloads to the embeddable chat API endpoint. It affects all systems running vulnerable versions of mintplex-labs/anything-llm, potentially causing service disruption and downtime.
💻 Affected Systems
- mintplex-labs/anything-llm
📦 What is this software?
Anythingllm by Mintplexlabs
⚠️ Risk & Real-World Impact
Worst Case
Complete service outage with server crashes, requiring manual restart and potentially causing data loss or corruption in active sessions.
Likely Case
Temporary service disruption and downtime until the server is manually restarted, affecting all users of the chat functionality.
If Mitigated
Minimal impact with proper input validation and exception handling preventing crashes.
🎯 Exploit Status
Exploitation requires sending malformed JSON to the vulnerable API endpoint; no authentication needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.2.2
Vendor Advisory: https://github.com/mintplex-labs/anything-llm/commit/548da9ade30368289c5beaf0a8ee2ed2b5c1d81c
Restart Required: Yes
Instructions:
1. Update to version 1.2.2 or later. 2. Restart the Anything-LLM service. 3. Verify the fix by checking the version.
🔧 Temporary Workarounds
Input Validation Filter
allImplement a web application firewall or reverse proxy to filter malformed JSON requests before they reach the API endpoint.
API Endpoint Restriction
allRestrict access to the embeddable chat API endpoint using network ACLs or authentication.
🧯 If You Can't Patch
- Implement rate limiting on the API endpoint to reduce attack surface.
- Deploy monitoring to detect and alert on malformed JSON payloads in logs.
🔍 How to Verify
Check if Vulnerable:
Check if the Anything-LLM version is below 1.2.2 and the embeddable chat API is accessible.Check Version:
Check the application version in the web interface or configuration files.Verify Fix Applied:
Confirm the version is 1.2.2 or later and test sending malformed JSON to the API endpoint to ensure it doesn't crash.📡 Detection & Monitoring
Log Indicators:
- Uncaught exception logs related to JSON parsing
- Server crash/restart events
- High volume of malformed requests to chat API
Network Indicators:
- Spikes in requests to the embeddable chat API endpoint
- Malformed JSON payloads in network traffic
SIEM Query:
source="anything-llm" AND (error OR exception OR crash) AND json