CVE-2024-4084: Mintplexlabs AnythingLLM SSRF Vulnerability

CVE-2024-4084 Overview

CVE-2024-4084 is a Server-Side Request Forgery (SSRF) vulnerability in mintplex-labs/anything-llm. The flaw allows attackers to bypass an existing fix that restricts access to intranet IP addresses and non-HTTP protocols. The original mitigation uses regular expressions to block addresses beginning with 192, 172, 10, and 127, and limits requests to HTTP and HTTPS. Attackers defeat these filters using alternative IP representations and by targeting alternate ports bound to localhost. Successful exploitation enables internal network reconnaissance, attacks against internal web services, host scanning, and access to cloud metadata endpoints such as the AWS instance metadata service.

Critical Impact
Attackers can reach internal-only assets, pivot to internal services, and retrieve AWS metadata credentials from vulnerable AnythingLLM deployments.

Affected Products

Mintplex Labs AnythingLLM (latest version at time of disclosure)
Deployments exposing user-controlled URL fetching functionality
Self-hosted instances running on cloud infrastructure with instance metadata services

Discovery Timeline

2024-06-05 - CVE-2024-4084 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-4084

Vulnerability Analysis

The vulnerability is classified as SSRF under [CWE-918]. AnythingLLM accepts user-supplied URLs and issues server-side requests to fetch remote content. A prior patch attempted to block access to internal networks by rejecting URLs whose hostname matched patterns for private address ranges. That patch relies on textual matching against dotted-quad prefixes rather than resolving and normalizing the host to an IP address.

Because the filter is applied only to the literal string form, attackers submit equivalent addresses in decimal, octal, hexadecimal, or IPv6-mapped notation. These representations resolve to the same private hosts but do not match the regular expressions. The protocol allowlist covers HTTP and HTTPS, so attackers still reach any TCP service that speaks HTTP on localhost or in the intranet range, including administrative interfaces bound to non-standard ports.

Root Cause

The root cause is insufficient validation of user-supplied URLs. The application trusts a regex-based denylist over the parsed and resolved destination address. The check does not canonicalize the hostname, does not resolve DNS to inspect the final IP, and does not re-validate after redirects. This produces a classic filter-bypass condition that CWE-918 describes.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker submits a crafted URL to any AnythingLLM feature that fetches remote content on the server. Bypass techniques include encoding 127.0.0.1 as its decimal equivalent 2130706433, hex form 0x7f000001, or IPv4-mapped IPv6 forms such as [::ffff:127.0.0.1]. Attackers also request ports other than the AnythingLLM service port on localhost to interact with adjacent services. On AWS-hosted instances, requests to http://169.254.169.254/latest/meta-data/ can retrieve instance metadata and, where the legacy IMDSv1 is enabled, temporary IAM credentials.

No verified public exploit code is available. Further technical detail is available in the Huntr Bounty Listing.

Detection Methods for CVE-2024-4084

Indicators of Compromise

Outbound HTTP requests from the AnythingLLM process to 169.254.169.254, 127.0.0.1, or RFC1918 addresses that were not initiated by the operator.
URL fetch requests whose host component uses decimal, octal, or hexadecimal IP encodings.
Application logs showing user-submitted URLs targeting non-standard localhost ports.
Unexpected access to internal admin panels, databases, or metadata services timed closely with AnythingLLM URL ingestion events.

Detection Strategies

Inspect AnythingLLM request logs for URL parameters that resolve to private, loopback, or link-local addresses after normalization.
Correlate application fetch events with egress network telemetry to identify requests reaching internal ranges.
Alert on any HTTP request from the AnythingLLM host to the cloud instance metadata endpoint.

Monitoring Recommendations

Enable and centralize AnythingLLM access logs, including the raw URL submitted by users.
Monitor egress connections from the workload to loopback, RFC1918, and 169.254.0.0/16 destinations.
Track authentication events on internal services for connections sourced from the AnythingLLM host.

How to Mitigate CVE-2024-4084

Immediate Actions Required

Upgrade AnythingLLM to a release that supersedes the flawed SSRF filter. Consult the Huntr Bounty Listing for the fix reference.
Enforce IMDSv2 with session tokens on AWS instances hosting AnythingLLM to prevent metadata credential theft.
Restrict egress from the AnythingLLM workload to only the destinations required for operation.

Patch Information

Mintplex Labs addressed the initial SSRF issue and this bypass in subsequent releases of AnythingLLM. Operators should track the project repository and upgrade to the latest tagged version. The referenced Huntr bounty entry documents the bypass and links to the code changes.

Workarounds

Deploy AnythingLLM behind an egress proxy that blocks connections to loopback, RFC1918, and link-local ranges after DNS resolution.
Run the service in a network namespace or container with no route to internal management networks or metadata endpoints.
Disable or gate URL-fetching features until the upgraded build is deployed.

bash

# Example: block metadata and private ranges at the host firewall (iptables)
iptables -A OUTPUT -m owner --uid-owner anythingllm -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -m owner --uid-owner anythingllm -d 127.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner anythingllm -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner anythingllm -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner anythingllm -d 192.168.0.0/16 -j REJECT