AnythingLLM - Information Disclosure

highseverity

7.5CVSS score

36.3%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

AnythingLLM suffers from an information disclosure vulnerability through the `/api/setup-complete` API endpoint. By accessing this endpoint, a remote and unauthenticated attacker can access sensitive configuration of the target AnythingLLM instance. This detection is included in the AI and LLM category.

Impact

An attacker can use the vulnerability to obtain device administrator rights.

Fix

Update AnythingLLM to the latest version and implement proper authentication for the setup-complete API endpoint.

How to confirm it

Send: GET {{BaseURL}}/api/setup-complete
Positive when: contains_all(body, "AuthToken\":true", "ApiKey\":true") and contains(header, "application/json") and status_code == 200 AND contains "\"AgentGoogleSearchEngineId\":" or "-\"AgentGoogleSearchEngineKey\":'" or "\"AgentSerperApiKey\":" or "\"AgentBingSearchApiKey\":"

Run it with nuclei: nuclei -id CVE-2024-6842 -u <target>

The full check

id: CVE-2024-6842

info:
  name: AnythingLLM - Information Disclosure
  author: ingbunga,rahaaaiii,asteria121,breakpack,gy741
  severity: high
  description: |
    AnythingLLM suffers from an information disclosure vulnerability through the `/api/setup-complete` API endpoint. By accessing this endpoint, a remote and unauthenticated attacker can access sensitive configuration of the target AnythingLLM instance. This detection is included in the AI and LLM category.
  remediation: |
    Update AnythingLLM to the latest version and implement proper authentication for the setup-complete API endpoint.
  impact: |
    An attacker can use the vulnerability to obtain device administrator rights.
  reference:
    - https://huntr.com/bounties/cd911fc7-ac6b-4974-acd0-9cc926fa8d9e
    - https://nvd.nist.gov/vuln/detail/CVE-2024-6842
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2024-6842
    cwe-id: CWE-200
    epss-score: 0.36276
    epss-percentile: 0.98494
  metadata:
    max-request: 1
    verified: true
    vendor: Mintplex Labs
    product: anything-llm
    shodan-query: title:"AnythingLLM"
  tags: cve,cve2024,unauth,exposure,anything-llm,mintplex-Labs,vuln,ai

http:
  - method: GET
    path:
      - "{{BaseURL}}/api/setup-complete"

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body, "AuthToken\":true", "ApiKey\":true")'
          - 'contains(header, "application/json")'
          - 'status_code == 200'
        condition: and

      - type: word
        part: body
        words:
          - '"AgentGoogleSearchEngineId":'
          - -"AgentGoogleSearchEngineKey":'
          - '"AgentSerperApiKey":'
          - '"AgentBingSearchApiKey":'
        condition: or

References

Use this check only on systems you are authorised to test. Where the data comes from