CVE-2024-0759
Assigner: @huntr_ai
Published: 2024-02-27T05:12:38.318Z
State: PUBLISHED
title: Collection of internally resolving IPs
descriptions: value: Should an instance of AnythingLLM be hosted on an internal network and the attacked be explicitly granted a permission level of manager or admin, they could link-scrape internally resolving IPs of other services that are on the same network as AnythingLLM.

This would require the attacker also be able to guess these internal IPs as `/*` ranging is not possible, but could be brute forced.

There is a duty of care that other services on the same network would not be fully open and accessible via a simple CuRL with zero authentication as it is not possible to set headers or access via the link collector.
affected: vendor: mintplex-labs
product: mintplex-labs/anything-llm
versions: version: unspecified
lessThan: 1.0.0
status: affected
versionType: custom
metrics: cvssV3_0: version: 3.0
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
baseScore: 7.7
baseSeverity: HIGH
problemTypes: descriptions: type: CWE
description: CWE-918 Server-Side Request Forgery (SSRF)
cweId: CWE-918
source: advisory: 9a978edd-ac94-41fc-8e3e-c35441bdd12b
discovery: EXTERNAL