Resource exhaustion in Mintplex-Labs Mintplex-Labs/anything-Llm
CVE-2024-5208
An uncontrolled resource consumption vulnerability exists in the `upload-link` endpoint of mintplex-labs/anything-llm. This vulnerability allows attackers to cause a denial of service (DOS) by shutting down the server through sending invalid upload requests. Specifically, the server can be made to shut down by sending an empty body with a 'Content-Length: 0' header or by sending a body with arbitrary content, such as 'asdasdasd', with a 'Content-Length: 9' header. The vulnerability is reproducible by users with at least a 'Manager' role, sending a crafted request to any workspace. This issue indicates that a previous fix was not effective in mitigating the vulnerability.
EPSS: 0.006 (46.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.
Affected products
- Mintplex-labs Mintplex-labs/anything-llm — versions unspecified
- Mintplexlabs Anythingllm
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security@huntr.dev (Exploit, Third Party Advisory)
- security@huntr.dev (Patch)
Frequently asked questions
- What is CVE-2024-5208?
- CVE-2024-5208 is a medium-severity vulnerability in Mintplex-Labs Mintplex-Labs/anything-Llm, classified under Allocation of Resources Without Limits or Throttling. CVSS score: 6.5/10. Published 2024-06-19.
- How severe is CVE-2024-5208?
- Medium severity. CVSS v3 base score is 6.5 out of 10.
- Is CVE-2024-5208 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.