CVE-2024-0765: 
Homebrew vulnerability analysis and mitigation

A vulnerability in AnythingLLM (CVE-2024-0765) allows default and manager role users to access sensitive system database information, including usernames, passwords, and API keys through the data export functionality. The vulnerability was discovered on January 10th, 2024, and affects multi-user instances of AnythingLLM (Red Hat CVE, Huntr Report).

The vulnerability exists in the /export-data endpoint of the system, where users with default or manager roles can execute a call to export system data. After downloading the export, users can unzip and read the contents, which contains sensitive database information. The vulnerability has been assigned a CVSS score of 9.6 (Critical), with network-based attack vector, low attack complexity, and low privileges required (Huntr Report).

The exploitation of this vulnerability leads to unauthorized access to sensitive system information, including usernames, passwords, and API keys. Additionally, post-download, the exported data is deleted, leaving no evidence of the exfiltration. This could potentially lead to further system compromise and unauthorized access to higher-privileged accounts (Red Hat CVE, Huntr Report).

The vulnerability is easily exploitable by any authenticated user with default or manager role permissions. The attacker needs to be granted explicit access to the system, but they can exploit this vulnerability with any role. A proof of concept exploit has been demonstrated using Python scripts to automate the process of data extraction (Huntr Report).

The vulnerability has been fixed in version 1.0.0 of AnythingLLM through commit 08d33cf, which removes support for import/export functionality. Users are advised to upgrade to this version or later to prevent unauthorized access to sensitive information (GitHub Commit).