CVE-2024-0455: Mintplexlabs AnythingLLM Disclosure Flaw

CVE-2024-0455 Overview

CVE-2024-0455 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] in Mintplex Labs AnythingLLM. The web scraper feature accepts arbitrary URLs from authenticated users with manager, admin, or single-user roles. Attackers can supply the AWS EC2 Instance Metadata Service (IMDS) URL http://169.254.169.254/ to retrieve temporary IAM credentials attached to the instance profile. Successful exploitation grants control over the underlying EC2 instance regardless of who deployed it.

Critical Impact
Extraction of AWS IAM credentials from the EC2 metadata service, enabling takeover of the hosting AWS environment.

Affected Products

Mintplex Labs AnythingLLM (deployed on AWS EC2)
AnythingLLM CloudFormation deployments prior to patch commit b2b2c2a
AnythingLLM instances lacking outbound firewall or iptables restrictions to 169.254.169.254

Discovery Timeline

2024-02-26 - CVE-2024-0455 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-0455

Vulnerability Analysis

AnythingLLM ships with a web scraper that fetches remote content on behalf of the user. The scraper does not validate or filter target URLs against link-local, loopback, or cloud metadata address ranges. Any user holding manager or admin authorization, or any user operating in single-user mode, can submit a URL for the server to fetch. When the AnythingLLM host runs on AWS EC2, the scraper reaches the Instance Metadata Service at 169.254.169.254 and returns the response body to the requester.

The metadata endpoint /latest/meta-data/identity-credentials/ec2/security-credentials/ec2-instance returns temporary AWS credentials tied to the instance profile. With those credentials, an attacker can call AWS APIs directly and perform any action permitted by the attached IAM role.

Root Cause

The root cause is missing URL validation in the scraper request path combined with unrestricted egress from the host to the IMDS address. The application trusts authenticated users to submit safe URLs and issues server-side fetches without an allow-list, deny-list, or DNS resolution check. The deployment template does not block traffic from non-root processes to 169.254.169.254 by default.

Attack Vector

Exploitation requires an authenticated session with manager or admin permissions, or single-user mode access. The attacker submits the IMDS URL through the scraper interface. The AnythingLLM backend performs the request from within the EC2 instance and returns the credentials JSON. The attacker then uses aws-cli or SDK calls with the returned AccessKeyId, SecretAccessKey, and Token to interact with AWS services.

text

// Patch: cloud-deployments/aws/cloudformation/cloudformation_create_anythingllm.json
                 "\n",
                 "#!/bin/bash\n",
                 "# check output of userdata script with sudo tail -f /var/log/cloud-init-output.log\n",
-                "sudo yum install docker -y\n",
+                "sudo yum install docker iptables -y\n",
+                "sudo iptables -A OUTPUT -m owner ! --uid-owner root -d 169.254.169.254 -j DROP\n",
                 "sudo systemctl enable docker\n",
                 "sudo systemctl start docker\n",
                 "mkdir -p /home/ec2-user/anythingllm\n",

Source: GitHub Commit b2b2c2a. The patch installs iptables and adds an OUTPUT rule that drops traffic destined for 169.254.169.254 originating from any user other than root, blocking scraper requests to IMDS.

Detection Methods for CVE-2024-0455

Indicators of Compromise

Outbound HTTP requests from the AnythingLLM process to 169.254.169.254
Scraper job entries in application logs referencing /latest/meta-data/ paths
AWS CloudTrail activity using the EC2 instance role from IP addresses outside the instance itself
Unexpected sts:GetCallerIdentity or iam:* calls originating from the AnythingLLM instance role

Detection Strategies

Alert on any process-level connection attempt to 169.254.169.254 from a non-root user on hosts running AnythingLLM.
Ingest AnythingLLM scraper logs into a SIEM and flag URL submissions containing 169.254.169.254, metadata.google.internal, or metadata.azure.com.
Correlate CloudTrail events against known instance IP addresses to identify credential replay from unexpected sources.

Monitoring Recommendations

Enable IMDSv2 with HttpPutResponseHopLimit=1 and monitor for legacy IMDSv1 usage via the MetadataNoToken CloudWatch metric.
Forward application, VPC Flow, and CloudTrail logs to a centralized data lake for cross-source correlation.
Track outbound egress from container workloads to link-local address ranges (169.254.0.0/16).

How to Mitigate CVE-2024-0455

Immediate Actions Required

Update AnythingLLM to a version that includes commit b2b2c2a or later.
Redeploy AWS CloudFormation stacks using the patched template so the iptables rule is applied on boot.
Enforce IMDSv2 on all EC2 instances hosting AnythingLLM and set the metadata hop limit to 1.
Rotate any IAM credentials associated with instance profiles attached to exposed AnythingLLM hosts.

Patch Information

Mintplex Labs fixed the issue in GitHub Commit b2b2c2a. The fix modifies the AWS CloudFormation user-data script to install iptables and add an OUTPUT rule that blocks non-root processes from reaching 169.254.169.254. Additional context is available in the Huntr Security Bounty report.

Workarounds

Apply a host-level iptables or nftables rule that drops egress traffic to 169.254.169.254 from non-root users.
Restrict AnythingLLM manager and admin role assignments to a minimal, trusted set of users.
Attach a least-privilege IAM role to the EC2 instance so that credential theft yields minimal permissions.
Run AnythingLLM behind an egress proxy that enforces an allow-list of destination hosts.

bash

# Configuration example: block IMDS access from non-root processes
sudo yum install -y iptables
sudo iptables -A OUTPUT -m owner ! --uid-owner root -d 169.254.169.254 -j DROP

# Enforce IMDSv2 on the EC2 instance
aws ec2 modify-instance-metadata-options \
    --instance-id i-0123456789abcdef0 \
    --http-tokens required \
    --http-put-response-hop-limit 1 \
    --http-endpoint enabled