CVE-2024-3149: Mintplexlabs AnythingLLM SSRF Vulnerability

CVE-2024-3149 Overview

CVE-2024-3149 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] in the upload link feature of mintplex-labs/anything-llm. The feature is restricted to users holding manager or administrator roles and processes submitted URLs through an internal Collector API using a headless browser. An attacker with such a role can host a malicious site and use the headless browser to reach internal network resources. The attack surface includes internal port scanning, access to non-public web applications, and direct interaction with the Collector API. Exploitation can result in arbitrary file deletion and limited Local File Inclusion (LFI), including reads against NGINX access logs that may hold sensitive data.

Critical Impact
An authenticated manager or administrator can pivot the Collector API's headless browser to internal services, delete arbitrary files, and read local files such as NGINX access logs.

Affected Products

mintplex-labs anything-llm (versions prior to the fix in commit f4088d9)
Deployments exposing the Collector API to the primary AnythingLLM server
Self-hosted and Dockerized AnythingLLM instances without RSA-signed server-to-collector communication

Discovery Timeline

2024-06-06 - CVE-2024-3149 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-3149

Vulnerability Analysis

AnythingLLM exposes an upload link workflow that hands submitted URLs to an internal Collector service. The Collector uses a headless browser to fetch and parse remote content for ingestion. Because the Collector accepts arbitrary URLs without egress restrictions and previously trusted unauthenticated calls from the main server, an attacker-controlled URL can steer the Collector toward internal endpoints. Redirects and script-driven navigation from the attacker's site can then reach the Collector's own API surface on the loopback or private network.

Once the Collector API becomes reachable in this way, the attacker can invoke ingestion endpoints that were never intended for external callers. These endpoints support operations that resolve to file operations on the Collector's host filesystem, enabling arbitrary file deletion and limited LFI. Reading NGINX access logs can disclose tokens, session identifiers, or query strings previously logged from other users.

Root Cause

The root cause is twofold: the upload link feature performs no destination allowlisting on URLs handed to the headless browser, and the Collector API lacked payload integrity verification between the server and collector components. Together these gaps let an authenticated manager or admin bounce requests through the headless browser into privileged internal APIs.

Attack Vector

Exploitation requires network access to an AnythingLLM instance and credentials with manager or admin privileges. The attacker submits a link to a malicious website through the upload link feature. The Collector fetches the page in a headless browser, where scripts or redirects direct the browser to internal hosts, ports, or the Collector API itself. Successful requests can enumerate internal services, invoke Collector endpoints, delete files, or read logs.

javascript

// Security patch: RSA-Signing on server<->collector communication (commit f4088d9)
+const { verifyPayloadIntegrity } = require("../middleware/verifyIntegrity");
 const { reqBody } = require("../utils/http");

 function extensions(app) {
   if (!app) return;

-  app.post("/ext/github-repo", async function (request, response) {
+  app.post("/ext/github-repo", [verifyPayloadIntegrity], async function (request, response) {
     try {
       const loadGithubRepo = require("../utils/extensions/GithubRepo");
       const { success, reason, data } = await loadGithubRepo(reqBody(request));

Source: GitHub commit f4088d9

Detection Methods for CVE-2024-3149

Indicators of Compromise

Collector logs showing headless browser fetches of loopback (127.0.0.1), link-local (169.254.0.0/16), or RFC1918 addresses
Upload link submissions pointing to non-HTTP(S) schemes or unusual ports on internal hosts
Unexpected file deletions or reads of /var/log/nginx/access.log on the Collector host
Unauthenticated POST requests to Collector /ext/* endpoints originating from the Collector itself

Detection Strategies

Correlate upload link submissions with subsequent outbound requests from the Collector service to internal address space.
Alert on Collector API calls that lack the verifyPayloadIntegrity signature header after patching.
Monitor filesystem auditing for delete or read operations on files outside the Collector's expected working directory.

Monitoring Recommendations

Enable process and file integrity monitoring on the Collector container or host, focused on log directories and application storage.
Capture NetFlow or eBPF telemetry from the Collector to identify traffic to internal ranges that should never be contacted.
Retain manager and admin audit trails for upload link submissions, including submitting user, timestamp, and destination URL.

How to Mitigate CVE-2024-3149

Immediate Actions Required

Upgrade AnythingLLM to a release that includes commit f4088d9 or later, which introduces RSA-signed server-to-collector communication via verifyPayloadIntegrity.
Audit and reduce the number of accounts holding manager or admin roles, since exploitation requires those privileges.
Isolate the Collector service on a network segment that cannot reach sensitive internal applications or metadata endpoints.

Patch Information

The fix is delivered in mintplex-labs/anything-llm commit f4088d9. The patch adds the verifyPayloadIntegrity middleware to Collector extension routes so that only the AnythingLLM server, holding the shared signing key, can invoke them. Additional context is available in the Huntr bounty report. A public proof-of-concept exists at the CVE-2024-31497 PoC repository.

Workarounds

Block the Collector service from initiating outbound connections to internal ranges (127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16).
Disable the upload link feature for all roles until the patched release is deployed.
Restrict Collector API listeners to loopback and require an authenticated reverse proxy in front of the AnythingLLM server.

bash

# Example egress restriction for the Collector container (iptables)
iptables -I OUTPUT -m owner --uid-owner collector -d 127.0.0.0/8 -j REJECT
iptables -I OUTPUT -m owner --uid-owner collector -d 10.0.0.0/8 -j REJECT
iptables -I OUTPUT -m owner --uid-owner collector -d 172.16.0.0/12 -j REJECT
iptables -I OUTPUT -m owner --uid-owner collector -d 192.168.0.0/16 -j REJECT
iptables -I OUTPUT -m owner --uid-owner collector -d 169.254.0.0/16 -j REJECT