CVE-2024-5208 (published 2024-06-19T06:15Z)

An uncontrolled resource consumption vulnerability exists in the `upload-link` endpoint of mintplex-labs/anything-llm. This vulnerability allows attackers to cause a denial of service (DOS) by shutting down the server through sending invalid upload requests. Specifically, the server can be made to shut down by sending an empty body with a 'Content-Length: 0' header or by sending a body with arbitrary content, such as 'asdasdasd', with a 'Content-Length: 9' header. The vulnerability is reproducible by users with at least a 'Manager' role, sending a crafted request to any workspace. This issue indicates that a previous fix was not effective in mitigating the vulnerability.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/mintplex-labs/anything-llm
commit_details: repo_url: https://github.com/mintplex-labs/anything-llm
author: timothycarambat
author_date: 2024-05-22 11:34:15-05:00
msg: patch endpoint without exception handler
repository: repo_url: https://github.com/mintplex-labs/anything-llm
repo_name: Mintplex-Labs/anything-llm
description: The all-in-one Desktop & Docker AI application with full RAG and AI Agent capabilities.
repo_language: JavaScript
owner: mintplex-labs
file_changes: filename: workspaces.js
change_type: ModificationType.MODIFY
diff: @@ -111,39 +111,45 @@ function workspaceEndpoints(app) {
       handleFileUpload,
     ],
     async function (request, response) {
-      const Collector = new CollectorApi();
-      const { originalname } = request.file;
-      const processingOnline = await Collector.online();
+      try {
+        const Collector = new CollectorApi();
+        const { originalname } = request.file;
+        const processingOnline = await Collector.online();
+
+        if (!processingOnline) {
+          response
+            .status(500)
+            .json({
+              success: false,
+              error: `Document processing API is not online. Document ${originalname} will not be processed automatically.`,
+            })
+            .end();
+          return;
+        }
 
-      if (!processingOnline) {
-        response
-          .status(500)
-          .json({
-            success: false,
-            error: `Document processing API is not online. Document ${originalname} will not be processed automatically.`,
-          })
-          .end();
-        return;
-      }
+        const { success, reason } =
+          await Collector.processDocument(originalname);
+        if (!success) {
+          response.status(500).json({ success: false, error: reason }).end();
+          return;
+        }
 
-      const { success, reason } = await Collector.processDocument(originalname);
-      if (!success) {
-        response.status(500).json({ success: false, error: reason }).end();
-        return;
+        Collector.log(
+          `Document ${originalname} uploaded processed and successfully. It is now available in documents.`
+        );
+        await Telemetry.sendTelemetry("document_uploaded");
+        await EventLogs.logEvent(
+          "document_uploaded",
+          {
+            documentName: originalname,
+          },
+          response.locals?.user?.id
+        );
+        response.status(200).json({ success: true, error: null });
+      } catch (e) {
+        console.log(e.message, e);
+        response.sendStatus(500).end();
       }
-
-      Collector.log(
-        `Document ${originalname} uploaded processed and successfully. It is now available in documents.`
-      );
-      await Telemetry.sendTelemetry("document_uploaded");
-      await EventLogs.logEvent(
-        "document_uploaded",
-        {
-          documentName: originalname,
-        },
-        response.locals?.user?.id
-      );
-      response.status(200).json({ success: true, error: null });
     }
   );
 
@@ -151,37 +157,42 @@ function workspaceEndpoints(app) {
     "/workspace/:slug/upload-link",
     [validatedRequest, flexUserRoleValid([ROLES.admin, ROLES.manager])],
     async (request, response) => {
-      const Collector = new CollectorApi();
-      const { link = "" } = reqBody(request);
-      const processingOnline = await Collector.online();
+      try {
+        const Collector = new CollectorApi();
+        const { link = "" } = reqBody(request);
+        const processingOnline = await Collector.online();
+
+        if (!processingOnline) {
+          response
+            .status(500)
+            .json({
+              success: false,
+              error: `Document processing API is not online. Link ${link} will not be processed automatically.`,
+            })
+            .end();
+          return;
+        }
 
-      if (!processingOnline) {
-        response
-          .status(500)
-          .json({
-            success: false,
-            error: `Document processing API is not online. Link ${link} will not be processed automatically.`,
-          })
-          .end();
-        return;
-      }
+        const { success, reason } = await Collector.processLink(link);
+        if (!success) {
+          response.status(500).json({ success: false, error: reason }).end();
+          return;
+        }
 
-      const { success, reason } = await Collector.processLink(link);
-      if (!success) {
-        response.status(500).json({ success: false, error: reason }).end();
-        return;
+        Collector.log(
+          `Link ${link} uploaded processed and successfully. It is now available in documents.`
+        );
+        await Telemetry.sendTelemetry("link_uploaded");
+        await EventLogs.logEvent(
+          "link_uploaded",
+          { link },
+          response.locals?.user?.id
+        );
+        response.status(200).json({ success: true, error: null });
+      } catch (e) {
+        console.log(e.message, e);
+        response.sendStatus(500).end();
       }
-
-      Collector.log(
-        `Link ${link} uploaded processed and successfully. It is now available in documents.`
-      );
-      await Telemetry.sendTelemetry("link_uploaded");
-      await EventLogs.logEvent(
-        "link_uploaded",
-        { link },
-        response.locals?.user?.id
-      );
-      response.status(200).json({ success: true, error: null });
     }
   );
 

programming_language: TypeScript