CVE-2025-63390
📋 TL;DR
An authentication bypass vulnerability in AnythingLLM v1.8.5 allows unauthenticated attackers to enumerate and retrieve detailed information about all configured workspaces via the /api/workspaces endpoint. This exposes sensitive configuration data including AI model settings, system prompts, and operational parameters. Organizations running vulnerable versions of AnythingLLM with internet-facing deployments are affected.
💻 Affected Systems
- AnythingLLM
📦 What is this software?
Anythingllm by Mintplexlabs
⚠️ Risk & Real-World Impact
Worst Case
Attackers could map the entire workspace structure, gather AI model configurations and system prompts, potentially enabling further attacks or intellectual property theft.
Likely Case
Unauthenticated information disclosure revealing workspace configurations, AI settings, and operational parameters that could aid in targeted attacks.
If Mitigated
Limited exposure if proper network segmentation and authentication controls are implemented.
🎯 Exploit Status
Simple HTTP GET request to /api/workspaces endpoint without authentication demonstrates the vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check latest version from Mintplex-Labs/anything-llm repository
Vendor Advisory: https://github.com/Mintplex-Labs/anything-llm/issues
Restart Required: Yes
Instructions:
1. Check current version using version command
2. Update to latest version from official repository
3. Restart the AnythingLLM service
4. Verify authentication is now required for /api/workspaces endpoint
🔧 Temporary Workarounds
Network Access Control
linuxRestrict access to AnythingLLM API endpoints using firewall rules or network segmentation
iptables -A INPUT -p tcp --dport [ANYTHINGLLM_PORT] -s [TRUSTED_NETWORK] -j ACCEPT
iptables -A INPUT -p tcp --dport [ANYTHINGLLM_PORT] -j DROP
Reverse Proxy Authentication
allImplement authentication at reverse proxy level before requests reach AnythingLLM
# Configure nginx with basic auth
location /api/ {
auth_basic "Restricted";
auth_basic_user_file /etc/nginx/.htpasswd;
proxy_pass http://localhost:[ANYTHINGLLM_PORT];
}
🧯 If You Can't Patch
- Implement strict network access controls to limit exposure to trusted networks only
- Monitor and alert on unauthorized access attempts to the /api/workspaces endpoint
🔍 How to Verify
Check if Vulnerable:
Send HTTP GET request to http://[TARGET]:[PORT]/api/workspaces without authentication. If it returns workspace data, system is vulnerable.Check Version:
Check AnythingLLM web interface or configuration for version informationVerify Fix Applied:
Attempt same unauthenticated request to /api/workspaces endpoint. Should receive authentication error or 401/403 response.📡 Detection & Monitoring
Log Indicators:
- Unauthenticated requests to /api/workspaces endpoint
- Multiple GET requests to workspace API from single IP
Network Indicators:
- Unusual volume of requests to /api/workspaces from external IPs
- GET requests to /api/workspaces without authentication headers
SIEM Query:
source="web_logs" AND uri="/api/workspaces" AND NOT (auth_token EXISTS OR session_id EXISTS)