AVID-2026-R1465

Description

Privilege Escalation and Local File Inclusion in mintplex-labs/anything-llm (CVE-2024-3152)

Details

mintplex-labs/anything-llm is vulnerable to multiple security issues due to improper input validation in several endpoints. An attacker can exploit these vulnerabilities to escalate privileges from a default user role to an admin role, read and delete arbitrary files on the system, and perform Server-Side Request Forgery (SSRF) attacks. The vulnerabilities are present in the /request-token, /workspace/:slug/thread/:threadSlug/update, /system/remove-logo, /system/logo, and collector’s /process endpoints. These issues are due to the application’s failure to properly validate user input before passing it to prisma functions and other critical operations. Affected versions include the latest version prior to 1.0.0.

Reason for inclusion in AVID: The report describes CVE-2024-3152 affecting mintplex-labs/anything-llm with privilege escalation, LFI, and SSRF due to improper input validation. This is a software vulnerability in a general-purpose AI-oriented application/component that could be used within AI deployment stacks (serving/management of LLMs). It affects software used in AI pipelines (endpoints, Prisma integration) and could impact AI services, meeting the criteria for AI relevance and GP AI supply-chain risk. The evidence (CVE entry, affected components/versions, CVSS metrics) is explicit and sufficient.

References

• NVD entry
• https://huntr.com/bounties/46034fa0-d623-49f8-8ee8-390390181373
• https://github.com/mintplex-labs/anything-llm/commit/200bd7f0615347ed2efc07903d510e5a208b0afc

Affected or Relevant Artifacts

• Developer: mintplex-labs
• Deployer: mintplex-labs
• Artifact Details:

Impact

AVID Taxonomy Categorization

• Risk domains: Security
• SEP subcategories: S0100: Software Vulnerability
• Lifecycle stages: L06: Deployment

CVSS

CWE

Other information

• Report Type: Advisory
• Credits:
• Date Reported: 2024-06-06
• Version: 0.3.3
• AVID Entry