CVE-2024-3152: 
Homebrew vulnerability analysis and mitigation

The vulnerability CVE-2024-3152 affects mintplex-labs/anything-llm software versions prior to 1.0.0. The vulnerability stems from improper input validation in several endpoints, including /request-token, /workspace/:slug/thread/:threadSlug/update, /system/remove-logo, /system/logo, and collector's /process endpoints. This security issue was disclosed on June 6, 2024 (NVD).

The vulnerability is classified under CWE-755 (Improper Handling of Exceptional Conditions). The CVSS v3.1 base score is 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The issue arises from the application's failure to properly validate user input before passing it to prisma functions and other critical operations (NVD).

The vulnerability allows attackers to escalate privileges from a default user role to an admin role, read and delete arbitrary files on the system, and perform Server-Side Request Forgery (SSRF) attacks (NVD).

The vulnerability requires low attack complexity and low privileges to exploit, with no user interaction needed. The attack vector is network-accessible, making it remotely exploitable (NVD).

A patch has been released to address the vulnerability. Users should upgrade to version 1.0.0 or later of the anything-llm software. The fix includes improvements to the prisma query expansion on threads (GitHub Patch).