CVE-2024-10109: Mintplexlabs Anythingllm Privilege Escalation

CVE-2024-10109 Overview

CVE-2024-10109 is a broken access control vulnerability [CWE-863] in the mintplex-labs/anything-llm repository at commit 5c40419. The flaw exposes the /api/system/custom-models endpoint to low-privileged authenticated users. Attackers can modify the model's API key and base path without administrative rights. Successful exploitation enables API key leakage to attacker-controlled endpoints and denial of service against chat functionality by redirecting requests to invalid providers.

Critical Impact

A low-privileged authenticated user can rewrite the LLM provider configuration, exfiltrate API keys, and disrupt chat services for all users of the AnythingLLM instance.

Affected Products

• mintplex-labs/anything-llm at commit 5c40419
• AnythingLLM deployments in multi-user mode prior to the patch
• All versions predating commit 8d302c3f670c582b09d47e96132c248101447a11

Discovery Timeline

• 2025-03-20 - CVE-2024-10109 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-10109

Vulnerability Analysis

AnythingLLM exposes a POST route at /api/system/custom-models that accepts a provider, apiKey, and basePath in the request body. Before the patch, this route enforced only the validatedRequest middleware, which confirms that the caller is authenticated but does not verify the user's role. Any authenticated user, including default and manager roles, could invoke the endpoint.

Once called, the endpoint overwrites the system-wide LLM provider settings. An attacker can replace basePath with an attacker-controlled URL that logs incoming requests. Subsequent chat operations transmit the legitimate apiKey and prompts to the attacker's server. Setting an invalid provider or base path also breaks chat availability for the entire workspace, resulting in denial of service.

Root Cause

The root cause is missing authorization enforcement on a state-changing administrative endpoint. The route relied on authentication middleware alone and omitted the role-based flexUserRoleValid([ROLES.admin]) check that guards other privileged system routes. This is a classic instance of [CWE-863: Incorrect Authorization].

Attack Vector

Exploitation requires network access to the AnythingLLM API and a valid low-privileged account. The attacker sends a crafted POST request with a malicious basePath pointing to a listener they control. No user interaction is required, and the attack completes in a single request.

// Security patch in server/endpoints/system.js
// Source: https://github.com/mintplex-labs/anything-llm/commit/8d302c3f670c582b09d47e96132c248101447a11
 app.post(
   "/system/custom-models",
-  [validatedRequest],
+  [validatedRequest, flexUserRoleValid([ROLES.admin])],
   async (request, response) => {
     try {
       const { provider, apiKey = null, basePath = null } = reqBody(request);

The patch adds flexUserRoleValid([ROLES.admin]) to the middleware chain, restricting the endpoint to administrators. A parallel documentation improvement was applied to server/utils/middleware/multiUserProtected.js to clarify the role-validation contract.

Detection Methods for CVE-2024-10109

Indicators of Compromise

• Unexpected POST requests to /api/system/custom-models originating from non-admin user sessions
• LLM provider basePath values pointing to unknown or external hosts in the AnythingLLM configuration
• Outbound API traffic from the AnythingLLM host to previously unseen domains carrying LLM API keys
• Sudden chat failures across all workspaces following a configuration change

Detection Strategies

• Review AnythingLLM audit logs for system/custom-models calls correlated with the requesting user's role
• Alert on any change to the stored LLM provider configuration outside of an approved change window
• Compare the current basePath and provider values against a known-good baseline on a scheduled basis

Monitoring Recommendations

• Forward AnythingLLM application logs to a central SIEM and index the requesting user, endpoint, and response code
• Monitor egress DNS and TLS SNI for connections to non-approved LLM API endpoints
• Track LLM provider secret rotation events and reconcile them against administrator activity

How to Mitigate CVE-2024-10109

Immediate Actions Required

• Upgrade AnythingLLM to a build that includes commit 8d302c3f670c582b09d47e96132c248101447a11 or later
• Rotate any LLM provider API keys that were configured on the vulnerable instance
• Audit user accounts and revoke unnecessary low-privileged access to multi-user deployments
• Review recent modifications to /api/system/custom-models and validate the current provider configuration

Patch Information

The fix is available in the upstream repository via GitHub commit 8d302c3. The patch adds flexUserRoleValid([ROLES.admin]) to the route, restricting /system/custom-models to administrator accounts. Additional context is available on the Huntr bounty listing.

Workarounds

• Disable multi-user mode until the patched build is deployed, limiting the endpoint to the single administrator account
• Place AnythingLLM behind a reverse proxy that blocks /api/system/custom-models for non-admin sessions
• Restrict network egress from the AnythingLLM host to only approved LLM provider domains to contain API key exfiltration

# Example nginx rule to block the vulnerable endpoint from untrusted networks
location = /api/system/custom-models {
    allow 10.0.0.0/8;   # internal admin network only
    deny all;
    proxy_pass http://anythingllm_upstream;
}