Anythingllm
CVE-2024-6842
HIGH
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
4DescriptionCVE.org
In version 1.5.5 of mintplex-labs/anything-llm, the /setup-complete API endpoint allows unauthorized users to access sensitive system settings. The data returned by the currentSettings function includes sensitive information such as API keys for search engines, which can be exploited by attackers to steal these keys and cause loss of user assets.
AnalysisAI
AnythingLLM version 1.5.5 exposes sensitive system settings including search engine API keys through the unauthenticated /setup-complete endpoint. Attackers can steal API keys, enumerate system configuration, and leverage exposed credentials to compromise integrated services.
Technical ContextAI
The /setup-complete API endpoint calls the currentSettings function without authentication checks. The returned configuration data includes API keys for search engines (SerpAPI, Google Custom Search), embedding providers, vector databases, and other integrated services. These keys can be extracted and used to access the respective services at the organization's expense.
RemediationAI
Update to AnythingLLM version 1.5.6 or later. Rotate all API keys after patching. Never expose AnythingLLM directly to the internet without authentication. Implement network-level access restrictions. Monitor API key usage on all integrated services for unauthorized activity.
More in Anythingllm
View allmintplex-labs/anything-llm is vulnerable to path traversal attacks due to insufficient validation of user-supplied input
A remote code execution vulnerability exists in mintplex-labs/anything-llm due to improper handling of environment varia
Relative Path Traversal in GitHub repository mintplex-labs/anything-llm prior to 0.0.1. Rated critical severity (CVSS 9.
An improper authorization vulnerability exists in the mintplex-labs/anything-llm application, specifically within the '/
An improper access control vulnerability exists in the mintplex-labs/anything-llm application, specifically within the i
A mass assignment vulnerability exists in the `/api/invite/:code` endpoint of the mintplex-labs/anything-llm repository,
Improper Input Validation in GitHub repository mintplex-labs/anything-llm prior to 0.1.0. Rated critical severity (CVSS
In mintplex-labs/anything-llm, a vulnerability exists in the thread update process that allows users with Default or Man
A Server-Side Request Forgery (SSRF) vulnerability exists in the upload link feature of mintplex-labs/anything-llm. Rate
mintplex-labs/anything-llm is vulnerable to multiple security issues due to improper input validation in several endpoin
As a manager, you should not be able to modify a series of settings. Rated high severity (CVSS 8.8), this vulnerability
Improper Access Control in GitHub repository mintplex-labs/anything-llm prior to 0.1.0. Rated high severity (CVSS 8.8),
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today