CVE-2024-0550

2024-02-2805:15:08

Google

osv.dev

user privileges

api exploit

file download

7 High

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

8.7%

JSON

A user who is privileged already manager or admin can set their profile picture via the frontend API using a relative filepath to then user the PFP GET API to download any valid files.

The attacker would have to have been granted privileged permissions to the system before executing this attack.

References

github.com/mintplex-labs/anything-llm/commit/e1dcd5ded010b03abd6aa32d1bf0668a48e38e17

huntr.com/bounties/c6afeb5e-f211-4b3d-aa4b-6bad734217a6