AI PRP: RCE in anything-llm CVE-2024-3104

[frkngksl]

Hi,

I want to implement a detection plugin for CVE-2024-3104.

Software Detail: A full-stack application that enables you to turn any document, resource, or piece of content into context that any LLM can use as references during chatting. This application allows you to pick and choose which LLM or Vector Database you want to use as well as supporting multi-user management and permissions.

Vulnerability Detail: A remote code execution vulnerability exists in mintplex-labs/anything-llm due to improper handling of environment variables. Attackers can exploit this vulnerability by injecting arbitrary environment variables via the POST /api/system/update-env endpoint, which allows for the execution of arbitrary code on the host running anything-llm. The vulnerability is present in the latest version of anything-llm, with the latest commit identified as fde905aac1812b84066ff72e5f2f90b56d4c3a59. This issue has been fixed in version 1.0.0. Successful exploitation could lead to code execution on the host, enabling attackers to read and modify data accessible to the user running the service, potentially leading to a denial of service.

Ref: https://huntr.com/bounties/4f2fcb45-5828-4bec-985a-9d3a0ee00462
Ref: https://vulners.com/nvd/NVD:CVE-2024-3104

[tooryx]

Hey @frkngksl,

We are interested in this one. But let's wait for your previous contributions to be merged first.

~tooryx

[frkngksl]

Hey @tooryx, thanks for accepting this. My previous commit is approved by leonardo-doyensec and it is waiting to be merged. I just wanted to say that. Fyi

[frkngksl]

Hi @tooryx @maoning , can I start the development of this issue? My current PR is merged now.

#494

[frkngksl]

Hi @tooryx @maoning ,

Is there any reasons for waiting this issue?

[tooryx]

Hey @frkngksl,

You can go ahead, thank you!

~tooryx

[tooryx]

Hi @frkngksl,

Your PR has been merged. This usually means a reward will be granted. Google will start the internal QC process and the reward amount will be determined based on the quality of the detector report. Please be patient and allow up to a week for the QC process to finish. You'll be notified once the decision is made.

Thanks!

[frkngksl]

Hi @tooryx , thank you so much! Could you please assign me a new issue from my queue?

[tooryx]

We have several contributors to assign new item to, we will process all of them middle of next week when the panel meets. We will keep you updated.

~tooryx

[frkngksl]

Thanks a lot!

[tooryx]

Hi @frkngksl,

The reward has been granted. You will receive very soon a message about it on the ticket you opened.

~tooryx