-
Notifications
You must be signed in to change notification settings - Fork 176
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
AI PRP: RCE in anything-llm CVE-2024-3104 #504
Comments
Hey @frkngksl, We are interested in this one. But let's wait for your previous contributions to be merged first. ~tooryx |
Hey @tooryx, thanks for accepting this. My previous commit is approved by leonardo-doyensec and it is waiting to be merged. I just wanted to say that. Fyi |
Hey @frkngksl, You can go ahead, thank you! ~tooryx |
Hi @frkngksl, Your PR has been merged. This usually means a reward will be granted. Google will start the internal QC process and the reward amount will be determined based on the quality of the detector report. Please be patient and allow up to a week for the QC process to finish. You'll be notified once the decision is made. Thanks! |
Hi @tooryx , thank you so much! Could you please assign me a new issue from my queue? |
We have several contributors to assign new item to, we will process all of them middle of next week when the panel meets. We will keep you updated. ~tooryx |
Thanks a lot! |
Hi @frkngksl, The reward has been granted. You will receive very soon a message about it on the ticket you opened. ~tooryx |
Hi,
I want to implement a detection plugin for CVE-2024-3104.
Software Detail: A full-stack application that enables you to turn any document, resource, or piece of content into context that any LLM can use as references during chatting. This application allows you to pick and choose which LLM or Vector Database you want to use as well as supporting multi-user management and permissions.
Vulnerability Detail: A remote code execution vulnerability exists in mintplex-labs/anything-llm due to improper handling of environment variables. Attackers can exploit this vulnerability by injecting arbitrary environment variables via the
POST /api/system/update-env
endpoint, which allows for the execution of arbitrary code on the host running anything-llm. The vulnerability is present in the latest version of anything-llm, with the latest commit identified as fde905aac1812b84066ff72e5f2f90b56d4c3a59. This issue has been fixed in version 1.0.0. Successful exploitation could lead to code execution on the host, enabling attackers to read and modify data accessible to the user running the service, potentially leading to a denial of service.Ref: https://huntr.com/bounties/4f2fcb45-5828-4bec-985a-9d3a0ee00462
Ref: https://vulners.com/nvd/NVD:CVE-2024-3104
The text was updated successfully, but these errors were encountered: