XSS in Mintplex-Labs Mintplex-Labs/anything-Llm
CVE-2024-3570
A stored Cross-Site Scripting (XSS) vulnerability exists in the chat functionality of the mintplex-labs/anything-llm repository, allowing attackers to execute arbitrary JavaScript in the context of a user's session. By manipulating the ChatBot responses, an attacker can inject malicious scripts to perform actions on behalf of the user, such as creating a new admin account or changing the user's password, leading to a complete takeover of the AnythingLLM application. The vulnerability stems from the improper sanitization of user and ChatBot input, specifically through the use of `dangerouslySetInnerHTML`. Successful exploitation requires convincing an admin to add a malicious LocalAI ChatBot to their AnythingLLM instance.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.003 (23.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.
Affected products
- Mintplex-labs Mintplex-labs/anything-llm — versions unspecified
- Mintplexlabs Anythingllm
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security@huntr.dev (Exploit, Third Party Advisory)
- security@huntr.dev (Patch)
Frequently asked questions
- What is CVE-2024-3570?
- CVE-2024-3570 is a medium-severity vulnerability in Mintplex-Labs Mintplex-Labs/anything-Llm, classified under Cross-site Scripting. CVSS score: 5.4/10. Published 2024-04-10.
- How severe is CVE-2024-3570?
- Medium severity. CVSS v3 base score is 5.4 out of 10.
- Is CVE-2024-3570 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.