CVE-2024-5208

An uncontrolled resource consumption vulnerability exists in the `upload-link` endpoint of mintplex-labs/anything-llm. This vulnerability allows attackers to cause a denial of service (DOS) by shutting down the server through sending invalid upload requests. Specifically, the server can be made to shut down by sending an empty body with a 'Content-Length: 0' header or by sending a body with arbitrary content, such as 'asdasdasd', with a 'Content-Length: 9' header. The vulnerability is reproducible by users with at least a 'Manager' role, sending a crafted request to any workspace. This issue indicates that a previous fix was not effective in mitigating the vulnerability.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector : AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/mintplex-labs/anything-llm/commit/e2439c6d4c3cfdacd96cd1b7b92d1f89c3cc8459	Patch
https://huntr.com/bounties/6c8bdfa1-ec56-4b02-bde9-cfc27470e6ca	Exploit Third Party Advisory
https://github.com/mintplex-labs/anything-llm/commit/e2439c6d4c3cfdacd96cd1b7b92d1f89c3cc8459	Patch
https://huntr.com/bounties/6c8bdfa1-ec56-4b02-bde9-cfc27470e6ca	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:mintplexlabs:anythingllm:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2024-06-19 06:15

Updated : 2025-10-15 13:15

NVD link : CVE-2024-5208

Mitre link : CVE-2024-5208

CVE.ORG link : CVE-2024-5208

JSON object : View

Products Affected

mintplexlabs

anythingllm

CWE

CWE-770

Allocation of Resources Without Limits or Throttling

NVD-CWE-noinfo

{"id": "CVE-2024-5208", "cveTags": [], "metrics": {"cvssMetricV30": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2024-06-19T06:15:11.420", "references": [{"url": "https://github.com/mintplex-labs/anything-llm/commit/e2439c6d4c3cfdacd96cd1b7b92d1f89c3cc8459", "tags": ["Patch"], "source": "[email protected]"}, {"url": "https://huntr.com/bounties/6c8bdfa1-ec56-4b02-bde9-cfc27470e6ca", "tags": ["Exploit", "Third Party Advisory"], "source": "[email protected]"}, {"url": "https://github.com/mintplex-labs/anything-llm/commit/e2439c6d4c3cfdacd96cd1b7b92d1f89c3cc8459", "tags": ["Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://huntr.com/bounties/6c8bdfa1-ec56-4b02-bde9-cfc27470e6ca", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-770"}]}, {"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "An uncontrolled resource consumption vulnerability exists in the `upload-link` endpoint of mintplex-labs/anything-llm. This vulnerability allows attackers to cause a denial of service (DOS) by shutting down the server through sending invalid upload requests. Specifically, the server can be made to shut down by sending an empty body with a 'Content-Length: 0' header or by sending a body with arbitrary content, such as 'asdasdasd', with a 'Content-Length: 9' header. The vulnerability is reproducible by users with at least a 'Manager' role, sending a crafted request to any workspace. This issue indicates that a previous fix was not effective in mitigating the vulnerability."}, {"lang": "es", "value": "Existe una vulnerabilidad de consumo de recursos incontrolado en el endpoint `upload-link` de mintplex-labs/anything-llm. Esta vulnerabilidad permite a los atacantes provocar una denegaci\u00f3n de servicio (DOS) apagando el servidor mediante el env\u00edo de solicitudes de carga no v\u00e1lidas. Espec\u00edficamente, se puede hacer que el servidor se apague enviando un cuerpo vac\u00edo con un encabezado 'Content-Length: 0' o enviando un cuerpo con contenido arbitrario, como 'asdasdasd', con un encabezado 'Content-Length: 9'. . La vulnerabilidad es reproducible por usuarios con al menos un rol de \"Administrador\", enviando una solicitud manipulada a cualquier espacio de trabajo. Este problema indica que una soluci\u00f3n anterior no fue eficaz para mitigar la vulnerabilidad."}], "lastModified": "2025-10-15T13:15:46.230", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mintplexlabs:anythingllm:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0D667E32-5A5C-479C-BB81-47F3BCA38C13", "versionEndExcluding": "1.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}