CVE-2024-0759: AnythingLLM Information Disclosure Flaw

CVE-2024-0759 Overview

CVE-2024-0759 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] in Mintplex Labs AnythingLLM. The flaw resides in the application's link collector, which failed to validate destination hostnames before issuing HTTP requests. An authenticated user with manager or admin privileges can supply URLs that resolve to internal IP ranges. This allows the AnythingLLM server to scrape and return content from internal services co-located on the same network.

Exploitation requires the attacker to guess or brute force internal IP addresses, since wildcard ranging is not supported. The link collector also does not permit setting custom headers, limiting the scope of interaction with internal targets.

Critical Impact
An authenticated manager or admin can weaponize AnythingLLM as an internal HTTP proxy to enumerate and read content from unauthenticated internal services.

Affected Products

Mintplex Labs AnythingLLM (self-hosted deployments)
Versions prior to the patch commit 0db6c3b2aa1787a7054ffdaba975474f122c20eb
All AnythingLLM instances exposing the link collector endpoint to manager/admin users

Discovery Timeline

2024-02-27 - CVE-2024-0759 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-0759

Vulnerability Analysis

AnythingLLM's link collector accepts a URL from an authenticated user and issues a server-side HTTP request to fetch remote content for indexing. Prior to the patch, the validURL function in collector/utils/url/index.js only validated the URL protocol against http: and https:. It performed no checks against the resolved hostname or IP address.

This allowed a manager or admin to submit URLs targeting RFC 1918 private address space or loopback addresses. The AnythingLLM server, which typically runs inside a trusted network segment, would then issue outbound requests to those internal endpoints and return the response body to the requester. Adjacent services lacking authentication became reachable through the application.

Root Cause

The root cause is missing input validation on user-supplied URLs before performing outbound network fetches. The link collector trusted the URL parser's protocol check as sufficient. It did not restrict destination IP octets or resolve DNS names to verify they fell outside private ranges.

Attack Vector

An attacker with manager or admin permissions submits a link collection request pointing at an internal address such as http://192.168.1.10/admin or http://127.0.0.1:8080/status. The server fetches the resource using an unauthenticated curl-equivalent request and returns the response to the attacker. By brute forcing common internal IP ranges and ports, the attacker maps and reads adjacent internal services.

javascript

 const VALID_PROTOCOLS = ["https:", "http:"];
+const INVALID_OCTETS = [192, 172, 10, 127];
+
+function isInvalidIp({ hostname }) {
+  const IPRegex = new RegExp(
+    /^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$/gi
+  );
+  if (!IPRegex.test(hostname)) return false;
+  const [octetOne, ..._rest] = hostname.split(".");
+
+  // If fails to validate to number - abort and return as invalid.
+  if (isNaN(Number(octetOne))) return true;
+  return INVALID_OCTETS.includes(Number(octetOne));
+}
 
 function validURL(url) {
   try {
     const destination = new URL(url);
     if (!VALID_PROTOCOLS.includes(destination.protocol)) return false;
+    if (isInvalidIp(destination)) return false;
     return true;
   } catch {}
   return false;

Source: Mintplex Labs patch commit 0db6c3b

Detection Methods for CVE-2024-0759

Indicators of Compromise

Outbound HTTP requests from the AnythingLLM server process targeting RFC 1918 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or loopback (127.0.0.0/8)
Link collector activity in application logs referencing internal hostnames or IP literals
Sequential requests to incrementing internal IP addresses, indicating brute-force enumeration

Detection Strategies

Monitor AnythingLLM audit logs for link collection actions submitted by manager and admin accounts, correlating destination URLs against private IP ranges
Deploy egress filtering rules on the AnythingLLM host and alert on outbound traffic that never leaves the internal network
Baseline normal link-collector destinations and flag deviations to internal subnets or non-standard ports

Monitoring Recommendations

Forward application and network flow logs to a centralized analytics platform for correlation between user actions and outbound HTTP requests
Alert on any 200-response fetches from the AnythingLLM service to internal management interfaces such as :8080, :9090, or :8443
Review privilege assignments and flag any unexpected elevation to manager or admin roles

How to Mitigate CVE-2024-0759

Immediate Actions Required

Upgrade AnythingLLM to a version that includes commit 0db6c3b2aa1787a7054ffdaba975474f122c20eb or later
Audit all accounts currently assigned manager or admin roles and revoke unnecessary privileges
Segment the AnythingLLM host from sensitive internal services using network policies or firewall rules

Patch Information

Mintplex Labs addressed the issue in the commit Prevent private octets from link collection for self-hosted (#626). The patch adds an isInvalidIp check that rejects hostnames whose first octet matches 192, 172, 10, or 127. Additional context is available in the Huntr bounty listing.

Workarounds

Restrict outbound network access from the AnythingLLM container or host to only the specific external domains required for link collection
Place AnythingLLM in an isolated network segment with no route to internal management interfaces or metadata services
Limit manager and admin role assignment to trusted operators and require multi-factor authentication for those accounts

bash

# Example egress restriction using iptables to block private ranges from the AnythingLLM host
iptables -A OUTPUT -m owner --uid-owner anythingllm -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner anythingllm -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner anythingllm -d 192.168.0.0/16 -j REJECT
iptables -A OUTPUT -m owner --uid-owner anythingllm -d 127.0.0.0/8 -j REJECT