CVE-2024-5213

In mintplex-labs/anything-llm versions up to and including 1.5.3, an issue was discovered where the password hash of a user is returned in the response after login (`POST /api/request-token`) and after account creations (`POST /api/admin/users/new`). This exposure occurs because the entire User object, including the bcrypt password hash, is included in the response sent to the frontend. This practice could potentially lead to sensitive information exposure despite the use of bcrypt, a strong hashing algorithm. It is recommended not to expose any clues about passwords to the frontend.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/mintplex-labs/anything-llm/commit/9df4521113ddb9a3adb5d0e3941e7d494992629c	Patch
https://huntr.com/bounties/8794fb65-50aa-40e3-b348-a29838dbf63d	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:mintplexlabs:anythingllm:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2024-06-20 03:15

Updated : 2024-07-17 14:36

NVD link : CVE-2024-5213

Mitre link : CVE-2024-5213

CVE.ORG link : CVE-2024-5213

JSON object : View

Products Affected

mintplexlabs

anythingllm

CWE

CWE-1230

Exposure of Sensitive Information Through Metadata

{"id": "CVE-2024-5213", "cveTags": [], "metrics": {"cvssMetricV30": [{"type": "Secondary", "source": "security@huntr.dev", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.6}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2024-06-20T03:15:09.067", "references": [{"url": "https://github.com/mintplex-labs/anything-llm/commit/9df4521113ddb9a3adb5d0e3941e7d494992629c", "tags": ["Patch"], "source": "security@huntr.dev"}, {"url": "https://huntr.com/bounties/8794fb65-50aa-40e3-b348-a29838dbf63d", "tags": ["Exploit", "Third Party Advisory"], "source": "security@huntr.dev"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security@huntr.dev", "description": [{"lang": "en", "value": "CWE-1230"}]}], "descriptions": [{"lang": "en", "value": "In mintplex-labs/anything-llm versions up to and including 1.5.3, an issue was discovered where the password hash of a user is returned in the response after login (`POST /api/request-token`) and after account creations (`POST /api/admin/users/new`). This exposure occurs because the entire User object, including the bcrypt password hash, is included in the response sent to the frontend. This practice could potentially lead to sensitive information exposure despite the use of bcrypt, a strong hashing algorithm. It is recommended not to expose any clues about passwords to the frontend. "}, {"lang": "es", "value": "En las versiones de mintplex-labs/anything-llm hasta la 1.5.3 incluida, se descubri\u00f3 un problema por el cual el hash de la contrase\u00f1a de un usuario se devuelve en la respuesta despu\u00e9s de iniciar sesi\u00f3n (`POST /api/request-token`) y despu\u00e9s de la creaci\u00f3n de la cuenta. (`POST /api/admin/usuarios/nuevo`). Esta exposici\u00f3n se produce porque todo el objeto Usuario, incluido el hash de la contrase\u00f1a de bcrypt, se incluye en la respuesta enviada al frontend. Esta pr\u00e1ctica podr\u00eda conducir potencialmente a la exposici\u00f3n de informaci\u00f3n confidencial a pesar del uso de bcrypt, un potente algoritmo hash. Se recomienda no exponer ninguna pista sobre contrase\u00f1as en la interfaz."}], "lastModified": "2024-07-17T14:36:39.397", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mintplexlabs:anythingllm:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F14948BA-FCCF-4867-B27A-215B159DA3AD", "versionEndIncluding": "1.5.3"}], "operator": "OR"}]}], "sourceIdentifier": "security@huntr.dev"}