search

google / tsunami-security-scanner-plugins

This project aims to provide a central repository for many useful Tsunami Security Scanner plugins.
Apache License 2.0
880 stars 179 forks source link

AI PRP: RCE in anything-llm CVE-2024-3104 #504

Closed frkngksl closed 3 months ago

frkngksl commented 5 months ago

Hi,

I want to implement a detection plugin for CVE-2024-3104.

Software Detail: A full-stack application that enables you to turn any document, resource, or piece of content into context that any LLM can use as references during chatting. This application allows you to pick and choose which LLM or Vector Database you want to use as well as supporting multi-user management and permissions.

Vulnerability Detail: A remote code execution vulnerability exists in mintplex-labs/anything-llm due to improper handling of environment variables. Attackers can exploit this vulnerability by injecting arbitrary environment variables via the POST /api/system/update-env endpoint, which allows for the execution of arbitrary code on the host running anything-llm. The vulnerability is present in the latest version of anything-llm, with the latest commit identified as fde905aac1812b84066ff72e5f2f90b56d4c3a59. This issue has been fixed in version 1.0.0. Successful exploitation could lead to code execution on the host, enabling attackers to read and modify data accessible to the user running the service, potentially leading to a denial of service.

Ref: https://huntr.com/bounties/4f2fcb45-5828-4bec-985a-9d3a0ee00462 Ref: https://vulners.com/nvd/NVD:CVE-2024-3104

tooryx commented 5 months ago

Hey @frkngksl,

We are interested in this one. But let's wait for your previous contributions to be merged first.

~tooryx

frkngksl commented 5 months ago

Hey @tooryx, thanks for accepting this. My previous commit is approved by leonardo-doyensec and it is waiting to be merged. I just wanted to say that. Fyi

frkngksl commented 5 months ago

Hi @tooryx @maoning , can I start the development of this issue? My current PR is merged now.

https://github.com/google/tsunami-security-scanner-plugins/issues/494

frkngksl commented 4 months ago

Hi @tooryx @maoning ,

Is there any reasons for waiting this issue?

tooryx commented 4 months ago

Hey @frkngksl,

You can go ahead, thank you!

~tooryx

tooryx commented 3 months ago

Hi @frkngksl,

Your PR has been merged. This usually means a reward will be granted. Google will start the internal QC process and the reward amount will be determined based on the quality of the detector report. Please be patient and allow up to a week for the QC process to finish. You'll be notified once the decision is made.

Thanks!

frkngksl commented 3 months ago

Hi @tooryx , thank you so much! Could you please assign me a new issue from my queue?

tooryx commented 3 months ago

We have several contributors to assign new item to, we will process all of them middle of next week when the panel meets. We will keep you updated.

~tooryx

frkngksl commented 3 months ago

Thanks a lot!

tooryx commented 3 months ago

Hi @frkngksl,

The reward has been granted. You will receive very soon a message about it on the ticket you opened.

~tooryx