CVE-2024-13059
HIGHCVSS Vector
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4Tags
Description
A vulnerability in mintplex-labs/anything-llm prior to version 1.3.1 allows for path traversal due to improper handling of non-ASCII filenames in the multer library. This vulnerability can lead to arbitrary file write, which can subsequently result in remote code execution. The issue arises when the filename transformation introduces '../' sequences, which are not sanitized by multer, allowing attackers with manager or admin roles to write files to arbitrary locations on the server.
Analysis
AnythingLLM prior to version 1.3.1 contains a path traversal vulnerability through non-ASCII filename handling in the multer library. The filename transformation introduces ../ sequences that enable arbitrary file write, leading to remote code execution on the LLM application server.
Technical Context
The multer library processes uploaded filenames containing non-ASCII characters. During filename normalization/transformation, certain character sequences are converted to '../' paths. This allows an attacker to write files outside the intended upload directory, including overwriting application files or creating new executable scripts.
Affected Products
['AnythingLLM < 1.3.1', 'mintplex-labs/anything-llm']
Remediation
Update to AnythingLLM 1.3.1 or later. Implement filename sanitization that strips all path components. Use random filenames for uploads. Monitor application files for unexpected modifications.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today