CVE-2024-3166: Mintplexlabs AnythingLLM XSS Vulnerability

CVE-2024-3166 Overview

A Cross-Site Scripting (XSS) vulnerability exists in mintplex-labs/anything-llm, affecting both the desktop application version 1.2.0 and the latest version of the web application. The vulnerability arises from the application's feature to fetch and embed content from websites into workspaces, which can be exploited to execute arbitrary JavaScript code. In the desktop application, this flaw can be escalated to Remote Code Execution (RCE) due to insecure application settings, specifically the enabling of nodeIntegration and the disabling of contextIsolation in Electron's webPreferences. The issue has been addressed in version 1.4.2 of the desktop application.

Critical Impact

This XSS vulnerability can be escalated to full Remote Code Execution on the desktop application, allowing attackers to execute arbitrary system commands through insecure Electron configuration settings.

Affected Products

• mintplexlabs anythingllm_desktop (versions prior to 1.4.2)
• mintplexlabs anythingllm_webapp (latest version at time of disclosure)

Discovery Timeline

• 2024-06-06 - CVE CVE-2024-3166 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-3166

Vulnerability Analysis

This vulnerability exploits a fundamental weakness in how AnythingLLM handles external content fetched from websites and embedded into workspaces. When a user imports content from a malicious or compromised website, the application fails to properly sanitize the embedded data, allowing arbitrary JavaScript code to execute within the application context.

What makes this vulnerability particularly severe in the desktop application context is the insecure Electron configuration. The application was built with nodeIntegration enabled and contextIsolation disabled in the Electron webPreferences. This dangerous combination allows JavaScript executing in the renderer process to directly access Node.js APIs, effectively transforming a client-side XSS vulnerability into a full Remote Code Execution vector.

An attacker could craft a malicious website containing embedded JavaScript that, when fetched and rendered by AnythingLLM, would execute with full Node.js privileges. This could enable system command execution, file system access, credential theft, and complete system compromise.

Root Cause

The root cause stems from two compounding security issues: insufficient input sanitization when embedding external web content into workspaces, and insecure Electron security configurations. The nodeIntegration: true and contextIsolation: false settings in Electron's webPreferences violate security best practices by exposing Node.js APIs to the renderer process. When combined with the XSS vulnerability, this creates a critical attack chain allowing web-based JavaScript to access system-level functionality.

Attack Vector

The attack leverages network-based delivery through a malicious website. An attacker can host a crafted webpage containing malicious JavaScript payloads. When a victim uses AnythingLLM's workspace feature to fetch and embed content from this malicious site, the embedded JavaScript executes within the Electron application context. Due to the insecure webPreferences configuration, this JavaScript has direct access to Node.js APIs, enabling the attacker to:

1. Execute arbitrary system commands via require('child_process')
2. Read and write files on the local filesystem
3. Exfiltrate sensitive data from the user's system
4. Install persistent backdoors or malware
5. Access environment variables and credentials

The vulnerability requires user interaction (fetching content from a malicious website), but no authentication is required to host the malicious payload, making this accessible to unauthenticated remote attackers.

Detection Methods for CVE-2024-3166

Indicators of Compromise

• Unexpected outbound network connections originating from the AnythingLLM process to unknown external hosts
• Unusual child processes spawned by the Electron application, particularly command shells or scripting interpreters
• Suspicious JavaScript execution patterns in application logs or browser developer tools
• Unauthorized file system access or modifications in user directories

Detection Strategies

• Monitor for child process creation events from the AnythingLLM application process, especially cmd.exe, powershell.exe, bash, or sh invocations
• Implement endpoint detection rules to alert on Node.js API abuse patterns from Electron renderer processes
• Review workspace content imports for suspicious script tags, event handlers, or obfuscated JavaScript
• Deploy network monitoring to detect unexpected data exfiltration from desktop application processes

Monitoring Recommendations

• Enable verbose logging for the AnythingLLM application to capture content import activities
• Implement application-level sandboxing or containerization to limit potential RCE impact
• Monitor Electron process behavior using endpoint detection and response (EDR) solutions
• Regularly audit workspace imports and embedded content for malicious payloads

How to Mitigate CVE-2024-3166

Immediate Actions Required

• Upgrade AnythingLLM desktop application to version 1.4.2 or later immediately
• Audit existing workspaces for any potentially malicious embedded content from untrusted sources
• Restrict users from importing content from untrusted or unknown websites until patched
• Review system logs for any signs of compromise or unusual application behavior

Patch Information

The vulnerability has been addressed in version 1.4.2 of the AnythingLLM desktop application. The security fix includes proper input sanitization for embedded web content and corrects the insecure Electron webPreferences configuration. The patch commit can be reviewed at the AnythingLLM GitHub repository. Additional technical details about the vulnerability are available through the Huntr bounty listing.

Workarounds

• Temporarily disable or restrict the website content fetching and embedding feature until the patch is applied
• Use the web application version in a sandboxed browser environment as an interim measure
• Implement network-level restrictions to prevent the application from fetching content from untrusted domains
• Deploy application whitelisting to prevent unauthorized child process execution from the AnythingLLM process

# Verify AnythingLLM version to ensure patched version is installed
# Check application version in settings or package info
# Target version should be 1.4.2 or higher for desktop application