CVE-2024-10131: Remote Code Execution in infiniflow/ragflow
The addllm function in llmapp.py in infiniflow/ragflow version 0.11.0 contains a remote code execution (RCE) vulnerability. The function uses user-supplied input req['llmfactory'] and req['llmname'] to dynamically instantiate classes from various model dictionaries. This approach allows an attacker to potentially execute arbitrary code due to the lack of comprehensive input validation or sanitization. An attacker could provide a malicious value for 'llmfactory' that, when used as an index to these model dictionaries, results in the execution of arbitrary code.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-10131?
CVE-2024-10131 has been identified as a remote code execution (RCE) vulnerability, which is considered critical.
How do I fix CVE-2024-10131?
To fix CVE-2024-10131, update your Infiniflow Ragflow installation to a patched version that addresses this vulnerability.
What software is affected by CVE-2024-10131?
CVE-2024-10131 affects Infiniflow Ragflow version 0.11.0.
Is CVE-2024-10131 exploitable remotely?
Yes, CVE-2024-10131 can be exploited remotely due to how the `add_llm` function processes user input.
What are the potential impacts of CVE-2024-10131?
Exploitation of CVE-2024-10131 may allow an attacker to execute arbitrary code on the vulnerable system.