CVE-2024-6842

CVE-2024-6842 is a missing-authentication flaw (CWE-306) in Mintplex Labs AnythingLLM, in which the /setup-complete API endpoint in version 1.5.5 can be reached without any credentials. An unauthenticated network attacker simply sends a request to /setup-complete and receives the output of the currentSettings function, which includes sensitive configuration such as third-party search-engine API keys. By harvesting these keys the attacker can abuse the victim's third-party API accounts, potentially incurring costs or depleting quota (loss of user assets); the CVSS 7.5 score reflects high confidentiality impact with no integrity or availability impact. Any AnythingLLM 1.5.5 deployment whose HTTP API is reachable from an untrusted network (e.g., a Docker-based server instance) is affected, while installs bound to localhost are largely out of remote attackers' reach. Exploitation has not been confirmed in the wild and the issue is not on CISA's KEV list, but a public proof-of-concept exists and EPSS assigns a high 31.1% probability of exploitation within 30 days.

What to do: Upgrade AnythingLLM to a patched release as soon as one is available (check the vendor's GitHub releases; the advisory does not state a fixed version). As an interim mitigation, restrict network access to the /setup-complete endpoint (bind the service to localhost or place it behind authentication or a firewall) and rotate any search-engine API keys configured in the instance. Review access logs for unauthenticated requests to /setup-complete that may indicate keys were already exposed.