Anything llm CVE 2024 3104 templated

[robert-doyensec]

Also modified testbed at google/security-testbeds#207

{
  "scanStatus": "SUCCEEDED",
  "scanFindings": [{
    "targetInfo": {
      "networkEndpoints": [{
        "type": "IP_HOSTNAME_PORT",
        "ipAddress": {
          "addressFamily": "IPV4",
          "address": "192.168.65.254"
        },
        "port": {
          "portNumber": 8081
        },
        "hostname": {
          "name": "host.docker.internal"
        }
      }]
    },
    "networkService": {
      "networkEndpoint": {
        "type": "IP_HOSTNAME_PORT",
        "ipAddress": {
          "addressFamily": "IPV4",
          "address": "192.168.65.254"
        },
        "port": {
          "portNumber": 8081
        },
        "hostname": {
          "name": "host.docker.internal"
        }
      },
      "transportProtocol": "TCP",
      "serviceName": "http",
      "serviceContext": {
        "webServiceContext": {
        }
      }
    },
    "vulnerability": {
      "mainId": {
        "publisher": "GOOGLE",
        "value": "AnythingLLM_CVE_2024_3104"
      },
      "relatedId": [{
        "publisher": "CVE",
        "value": "CVE-2024-3104"
      }],
      "severity": "HIGH",
      "title": "CVE-2024-3104 anything-llm RCE",
      "description": "A remote code execution vulnerability exists in mintplex-labs/anything-llm due to improper handling of environment variables. Attackers can exploit this vulnerability by injecting arbitrary environment variables via the POST /api/system/update-env endpoint, which allows for the execution of arbitrary code on the host running anything-llm.Successful exploitation could lead to code execution on the host, enabling attackers to read and modify data accessible to the user running the service, potentially leading to a denial of service.",
      "recommendation": "You can upgrade your anything-llm instances to a version whose commit ID is bfedfebfab032e6f4d5a369c8a2f947c5d0c5286 or later."
    }
  }],
  "scanStartTimestamp": "2026-04-24T17:04:51.279Z",
  "scanDuration": "8.027s",
  "fullDetectionReports": {
    "detectionReports": [{
      "targetInfo": {
        "networkEndpoints": [{
          "type": "IP_HOSTNAME_PORT",
          "ipAddress": {
            "addressFamily": "IPV4",
            "address": "192.168.65.254"
          },
          "port": {
            "portNumber": 8081
          },
          "hostname": {
            "name": "host.docker.internal"
          }
        }]
      },
      "networkService": {
        "networkEndpoint": {
          "type": "IP_HOSTNAME_PORT",
          "ipAddress": {
            "addressFamily": "IPV4",
            "address": "192.168.65.254"
          },
          "port": {
            "portNumber": 8081
          },
          "hostname": {
            "name": "host.docker.internal"
          }
        },
        "transportProtocol": "TCP",
        "serviceName": "http",
        "serviceContext": {
          "webServiceContext": {
          }
        }
      },
      "detectionTimestamp": "2026-04-24T17:04:59.246Z",
      "detectionStatus": "VULNERABILITY_VERIFIED",
      "vulnerability": {
        "mainId": {
          "publisher": "GOOGLE",
          "value": "AnythingLLM_CVE_2024_3104"
        },
        "relatedId": [{
          "publisher": "CVE",
          "value": "CVE-2024-3104"
        }],
        "severity": "HIGH",
        "title": "CVE-2024-3104 anything-llm RCE",
        "description": "A remote code execution vulnerability exists in mintplex-labs/anything-llm due to improper handling of environment variables. Attackers can exploit this vulnerability by injecting arbitrary environment variables via the POST /api/system/update-env endpoint, which allows for the execution of arbitrary code on the host running anything-llm.Successful exploitation could lead to code execution on the host, enabling attackers to read and modify data accessible to the user running the service, potentially leading to a denial of service.",
        "recommendation": "You can upgrade your anything-llm instances to a version whose commit ID is bfedfebfab032e6f4d5a369c8a2f947c5d0c5286 or later."
      }
    }]
  },
  "reconnaissanceReport": {
    "targetInfo": {
      "networkEndpoints": [{
        "type": "IP_HOSTNAME_PORT",
        "ipAddress": {
          "addressFamily": "IPV4",
          "address": "192.168.65.254"
        },
        "port": {
          "portNumber": 8081
        },
        "hostname": {
          "name": "host.docker.internal"
        }
      }]
    },
    "networkServices": [{
      "networkEndpoint": {
        "type": "IP_HOSTNAME_PORT",
        "ipAddress": {
          "addressFamily": "IPV4",
          "address": "192.168.65.254"
        },
        "port": {
          "portNumber": 8081
        },
        "hostname": {
          "name": "host.docker.internal"
        }
      },
      "transportProtocol": "TCP",
      "serviceName": "http",
      "serviceContext": {
        "webServiceContext": {
        }
      }
    }]
  },
  "targetAlive": true
}#