SSRF auf AWS bereitgestellten Instanzen von AnythingLLM über /metadata

The SSRF vulnerability in AnythingLLM allows an attacker with appropriate authorization (manager, admin, or single-user) to retrieve AWS EC2 instance credentials. By injecting a specific URL (http://169.254.169.254/latest/meta-data/identity-credentials/ec2/security-credentials/ec2-instance), an attacker can obtain temporary security credentials associated with the EC2 instance hosting the application. These credentials can then be used to perform actions within the AWS environment as the EC2 instance, potentially including accessing other AWS resources, modifying configurations, or launching new instances. The blast radius extends to any AWS resources accessible by the compromised EC2 instance, and the impact is particularly severe in environments with sensitive data or critical infrastructure.

Organizations deploying AnythingLLM within Amazon EC2 environments are particularly at risk. Specifically, environments where manager or admin accounts have been configured with overly permissive access or where security best practices regarding EC2 instance credentials are not strictly enforced are highly vulnerable. Shared hosting environments utilizing AnythingLLM also present a heightened risk.

• nodejs / server:

ps aux | grep 'http://169.254.169.254'

• generic web:

curl -I 'http://your-anythingllm-instance/scrape?url=http://169.254.169.254/latest/meta-data/identity-credentials/ec2/security-credentials/ec2-instance' | grep 'HTTP/1.1 403' # Check for access denied

1. 2024-02-25Disclosure

   disclosure

1. Reserviert2024-01-12
2. Veröffentlicht2024-02-25
3. Geändert2024-08-12
4. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2024-0455 is to upgrade to version 1.0.0 of AnythingLLM, which addresses the SSRF vulnerability. If upgrading immediately is not feasible, consider implementing temporary workarounds. Restrict access to the web scraper functionality to only authorized users and carefully validate all user-supplied input. Implement network-level controls to prevent outbound requests to the EC2 metadata service (169.254.169.254) from the application server. Monitor application logs for suspicious requests targeting the metadata endpoint. After upgrading, confirm the fix by attempting to access the EC2 metadata endpoint through the application; the request should be denied.