CVE-2024-0759

{"id": "CVE-2024-0759", "metrics": {"cvssMetricV30": [{"type": "Secondary", "source": "security@huntr.dev", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 7.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 3.1}]}, "published": "2024-02-27T06:15:45.493", "references": [{"url": "https://github.com/mintplex-labs/anything-llm/commit/0db6c3b2aa1787a7054ffdaba975474f122c20eb", "source": "security@huntr.dev"}, {"url": "https://huntr.com/bounties/9a978edd-ac94-41fc-8e3e-c35441bdd12b", "source": "security@huntr.dev"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Primary", "source": "security@huntr.dev", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "Should an instance of AnythingLLM be hosted on an internal network and the attacked be explicitly granted a permission level of manager or admin, they could link-scrape internally resolving IPs of other services that are on the same network as AnythingLLM.\n\nThis would require the attacker also be able to guess these internal IPs as `/*` ranging is not possible, but could be brute forced.\n\nThere is a duty of care that other services on the same network would not be fully open and accessible via a simple CuRL with zero authentication as it is not possible to set headers or access via the link collector."}, {"lang": "es", "value": "Si una instancia de AnythingLLM est\u00e1 alojada en una red interna y al atacado se le concede expl\u00edcitamente un nivel de permiso de administrador o administrador, podr\u00edan vincular IP de resoluci\u00f3n interna de otros servicios que est\u00e9n en la misma red que AnythingLLM. Esto requerir\u00eda que el atacante tambi\u00e9n pudiera adivinar estas IP internas, ya que el rango `/*` no es posible, pero podr\u00eda ser forzado de forma bruta. Existe el deber de tener cuidado de que otros servicios en la misma red no est\u00e9n completamente abiertos y accesibles a trav\u00e9s de un CuRL simple sin autenticaci\u00f3n, ya que no es posible configurar encabezados o acceder a trav\u00e9s del recopilador de enlaces."}], "lastModified": "2024-03-07T20:15:50.480", "sourceIdentifier": "security@huntr.dev"}