Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Executive Summary

The vulnerability in AnythingLLM prior to version 1.13.0 on Windows involves the document folder listing route accepting an encoded absolute Windows path that can resolve outside the intended documents directory.

While the shared path containment helper rejects POSIX-style "../" traversal, it does not reject Windows-style parent paths such as ".." returned by path.relative(). This allows traversal outside the intended directory.

This means an attacker could potentially access files outside the designated documents folder by exploiting this path traversal issue.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized access to files outside the intended documents directory on a Windows system running vulnerable versions of AnythingLLM.

Such unauthorized access could expose sensitive or confidential information stored outside the documents folder, potentially leading to data leakage.

However, the CVSS score of 4.3 indicates a low to medium severity impact, with limited confidentiality impact and no integrity or availability impact.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade AnythingLLM to version 1.13.0 or later, where the issue with Windows-style path traversal has been fixed.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by attempting to access JSON document metadata from folders outside the intended documents root directory on a Windows deployment of AnythingLLM prior to version 1.13.0.

Specifically, an authenticated user with an API key can try to provide an encoded absolute Windows path that uses Windows-style parent paths such as ".." to see if the system returns an HTTP 200 response with external file listings instead of the expected HTTP 404 error.

• Use an HTTP client (e.g., curl or Postman) to send requests to the document folder listing route with encoded Windows absolute paths containing ".." segments.
• Example curl command to test the vulnerability (replace <API_KEY> and <TARGET_URL> accordingly):
• curl -H "Authorization: Bearer <API_KEY>" "<TARGET_URL>/document-folder?path=%5C..%5Csome_sibling_folder"

If the response is HTTP 200 and returns metadata from outside the intended documents directory, the system is vulnerable.

Useful 0 Not Useful 0