CVE-2024-3033

The '/api/v/' endpoint and its sub-paths do not enforce any identity verification or authorization checks, meaning that any remote user without authentication can send requests to them. An attacker can reset the entire VectorDB database, delete selected namespaces, or list all existing namespaces. The absence of access control mechanisms means that no application security measures can prevent these operations.

An attacker can cause complete data loss of document embeddings across all workspaces, rendering chats in workspaces and chat widgets non-functional. Additionally, it is possible to disclose private workspace names by listing them.

Update the mintplex-labs/anything-llm application to version 1.0.0 or later, which includes the fix (commit bf8df60c02b9ddc7ba682809ca12c5637606393a). Until the update is applied, it is recommended to restrict network access to '/api/v/' endpoints exclusively to trusted hosts using firewall or proxy mechanisms.

All versions of the mintplex-labs/anything-llm application up to and including the last version before the fix; the fix was introduced in version 1.0.0.