Vulnerability · Published Feb 27, 2024 · Assigned by @huntr_ai
CVE-2024-0759Collection of internally resolving IPs
High 7.7
In plain English
A high-severity server-side request forgery in mintplex-labs/anything-llm from mintplex-labs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 60% of all known vulnerabilities).
Official description
Should an instance of AnythingLLM be hosted on an internal network and the attacked be explicitly granted a permission level of manager or admin, they could link-scrape internally resolving IPs of other services that are on the same network as AnythingLLM. This would require the attacker also be able to guess these internal IPs as `/*` ranging is not possible, but could be brute forced. There is a duty of care that other services on the same network would not be fully open and accessible via a simple CuRL with zero authentication as it is not possible to set headers or access via the link collector.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| mintplex-labs | mintplex-labs/anything-llm | unspecified – before 1.0.0 |
Weakness: CWE-918 · Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N