CVE-2024-6842
HIGHCVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
4Description
In version 1.5.5 of mintplex-labs/anything-llm, the `/setup-complete` API endpoint allows unauthorized users to access sensitive system settings. The data returned by the `currentSettings` function includes sensitive information such as API keys for search engines, which can be exploited by attackers to steal these keys and cause loss of user assets.
Analysis
AnythingLLM version 1.5.5 exposes sensitive system settings including search engine API keys through the unauthenticated /setup-complete endpoint. Attackers can steal API keys, enumerate system configuration, and leverage exposed credentials to compromise integrated services.
Technical Context
The /setup-complete API endpoint calls the currentSettings function without authentication checks. The returned configuration data includes API keys for search engines (SerpAPI, Google Custom Search), embedding providers, vector databases, and other integrated services. These keys can be extracted and used to access the respective services at the organization's expense.
Affected Products
['AnythingLLM <= 1.5.5', 'mintplex-labs/anything-llm']
Remediation
Update to AnythingLLM version 1.5.6 or later. Rotate all API keys after patching. Never expose AnythingLLM directly to the internet without authentication. Implement network-level access restrictions. Monitor API key usage on all integrated services for unauthorized activity.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today