search

google / tsunami-security-scanner-plugins

This project aims to provide a central repository for many useful Tsunami Security Scanner plugins.
Apache License 2.0
860 stars 178 forks source link

AI PRP: RCE in anything-llm CVE-2024-3104 #504

Open frkngksl opened 2 weeks ago

frkngksl commented 2 weeks ago

Hi,

I want to implement a detection plugin for CVE-2024-3104.

Software Detail: A full-stack application that enables you to turn any document, resource, or piece of content into context that any LLM can use as references during chatting. This application allows you to pick and choose which LLM or Vector Database you want to use as well as supporting multi-user management and permissions.

Vulnerability Detail: A remote code execution vulnerability exists in mintplex-labs/anything-llm due to improper handling of environment variables. Attackers can exploit this vulnerability by injecting arbitrary environment variables via the POST /api/system/update-env endpoint, which allows for the execution of arbitrary code on the host running anything-llm. The vulnerability is present in the latest version of anything-llm, with the latest commit identified as fde905aac1812b84066ff72e5f2f90b56d4c3a59. This issue has been fixed in version 1.0.0. Successful exploitation could lead to code execution on the host, enabling attackers to read and modify data accessible to the user running the service, potentially leading to a denial of service.

Ref: https://huntr.com/bounties/4f2fcb45-5828-4bec-985a-9d3a0ee00462 Ref: https://vulners.com/nvd/NVD:CVE-2024-3104

tooryx commented 1 week ago

Hey @frkngksl,

We are interested in this one. But let's wait for your previous contributions to be merged first.

~tooryx

frkngksl commented 1 week ago

Hey @tooryx, thanks for accepting this. My previous commit is approved by leonardo-doyensec and it is waiting to be merged. I just wanted to say that. Fyi

frkngksl commented 5 days ago

Hi @tooryx @maoning , can I start the development of this issue? My current PR is merged now.

https://github.com/google/tsunami-security-scanner-plugins/issues/494