CVE-2024-3152: AnythingLLM Privilege Escalation Vulnerability

CVE-2024-3152 Overview

CVE-2024-3152 affects mintplex-labs/anything-llm, an open-source document chat application that integrates large language models. The application fails to properly validate user input across several endpoints before passing it to prisma database functions and other critical operations. Attackers with a low-privileged account can escalate to admin, read and delete arbitrary files, and perform Server-Side Request Forgery (SSRF) attacks. Vulnerable endpoints include /request-token, /workspace/:slug/thread/:threadSlug/update, /system/remove-logo, /system/logo, and the collector's /process endpoint. All versions prior to 1.0.0 are affected. The issue combines weaknesses tracked as [CWE-918] (SSRF) and [CWE-755] (improper handling of exceptional conditions).

Critical Impact
An authenticated low-privileged user can escalate to admin, exfiltrate or delete files on the host, and pivot to internal services via SSRF.

Affected Products

mintplex-labs anything-llm versions prior to 1.0.0
Deployments exposing the server API to authenticated non-admin users
Instances running the document collector service alongside the main application

Discovery Timeline

2024-06-06 - CVE-2024-3152 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-3152

Vulnerability Analysis

The application accepts client-supplied objects and forwards them into prisma model operations without filtering keys against a writable allowlist. On the /workspace/:slug/thread/:threadSlug/update endpoint, an attacker submits arbitrary field names in the request body, and the ORM propagates those fields directly into the underlying update statement. This mass-assignment behavior enables role manipulation and modification of records the caller should not control.

The /system/logo and /system/remove-logo endpoints accept file paths from the request without validation. An attacker supplies traversal sequences to read or delete files outside the intended logo directory. The collector's /process endpoint accepts remote URLs and fetches them server-side, permitting SSRF against internal metadata services and unexposed network resources.

Root Cause

Input validation logic filters valid keys after the object has already been constructed and, in the patched code path, the object passed to prisma retained all attacker-supplied keys. File-handling endpoints trust user-provided paths, and the collector performs outbound requests without target restrictions.

Attack Vector

Exploitation requires network access to the server and low-privileged authentication. No user interaction is required. An attacker sends crafted JSON bodies or query parameters to the vulnerable endpoints to trigger privilege escalation, arbitrary file access, or outbound SSRF.

javascript

// Patch applied in server/models/workspaceThread.js
// Enforces writable-key allowlist before passing data to prisma.update
 update: async function (prevThread = null, data = {}) {
   if (!prevThread) throw new Error("No thread id provided for update");

-    const validKeys = Object.keys(data).filter((key) =>
-      this.writable.includes(key)
-    );
-    if (validKeys.length === 0)
+    const validData = {};
+    Object.entries(data).forEach(([key, value]) => {
+      if (!this.writable.includes(key)) return;
+      validData[key] = value;
+    });
+
+    if (Object.keys(validData).length === 0)
     return { thread: prevThread, message: "No valid fields to update!" };

   try {
     const thread = await prisma.workspace_threads.update({
       where: { id: prevThread.id },
-        data,
+        data: validData,
     });
     return { thread, message: null };
   } catch (error) {

Source: mintplex-labs/anything-llm commit 200bd7f

Detection Methods for CVE-2024-3152

Indicators of Compromise

Unexpected role changes on user records, particularly transitions to admin originating from /workspace/*/thread/*/update or /request-token traffic.
HTTP POST bodies to the update endpoints containing fields outside the documented schema, such as role, password, or suspended.
Requests to /system/logo or /system/remove-logo containing .. sequences or absolute paths referencing sensitive files such as /etc/passwd or application config.
Outbound requests from the collector service targeting 169.254.169.254, 127.0.0.1, or RFC1918 addresses following a /process invocation.

Detection Strategies

Audit the anything-llm database for user accounts whose role field changed without a corresponding administrative action in application logs.
Instrument reverse-proxy or WAF logging to capture full request bodies on the affected endpoints for retroactive review.
Correlate authentication events with subsequent privileged API calls to identify low-privileged accounts performing admin-only operations.

Monitoring Recommendations

Alert on any egress from the collector container to link-local or internal IP ranges.
Monitor file system access on the anything-llm storage directory for reads or deletes issued by the web process outside expected paths.
Track privilege changes in the users table and generate an alert when the count of admins increases.

How to Mitigate CVE-2024-3152

Immediate Actions Required

Upgrade mintplex-labs/anything-llm to version 1.0.0 or later, which includes commit 200bd7f0.
Rotate all API tokens and force password resets for accounts that existed before the upgrade.
Review the users table and revoke unexpected admin roles.
Restrict network egress from the collector service to only the destinations required for document ingestion.

Patch Information

The vendor addressed the vulnerabilities in commit 200bd7f0615347ed2efc07903d510e5a208b0afc. The fix enforces a writable-key allowlist before passing user-controlled objects to prisma update operations and hardens the affected file and processing endpoints. Additional context is available in the Huntr bounty listing.

Workarounds

Place the application behind an authenticating reverse proxy that restricts access to trusted users until the upgrade is applied.
Block requests containing path traversal sequences on /system/logo and /system/remove-logo at the WAF layer.
Deny outbound traffic from the collector container to link-local, loopback, and RFC1918 ranges to neutralize SSRF impact.

bash

# Example egress restriction for the collector container (iptables)
iptables -A OUTPUT -d 169.254.169.254 -j DROP
iptables -A OUTPUT -d 127.0.0.0/8 -j DROP
iptables -A OUTPUT -d 10.0.0.0/8 -j DROP
iptables -A OUTPUT -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -j DROP