Vulnerability · Published May 26, 2024 · Assigned by @huntr_ai
CVE-2024-4286Improper Neutralization of Special Elements in mintplex-labs/anything-llm
Medium 4.9
In plain English
A medium-severity expression language injection in mintplex-labs/anything-llm from mintplex-labs. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities).
Official description
Mintplex-Labs' anything-llm application is vulnerable to improper neutralization of special elements used in an expression language statement, identified in the commit id `57984fa85c31988b2eff429adfc654c46e0c342a`. The vulnerability arises from the application's handling of user modifications by managers or admins, allowing for the modification of all existing attributes of the `user` database entity without proper checks or sanitization. This flaw can be exploited to delete user threads, denying users access to their previously submitted data, or to inject fake threads and/or chat history for social engineering attacks.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| mintplex-labs | mintplex-labs/anything-llm | unspecified – before 1.0.0 |
Weakness: CWE-917 · Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N