CVE-2024-10131: Remote Code Execution in infiniflow/ragflow
First published: Sat Oct 19 2024(Updated: )
The `add_llm` function in `llm_app.py` in infiniflow/ragflow version 0.11.0 contains a remote code execution (RCE) vulnerability. The function uses user-supplied input `req['llm_factory']` and `req['llm_name']` to dynamically instantiate classes from various model dictionaries. This approach allows an attacker to potentially execute arbitrary code due to the lack of comprehensive input validation or sanitization. An attacker could provide a malicious value for 'llm_factory' that, when used as an index to these model dictionaries, results in the execution of arbitrary code.
Credit: security@huntr.dev
| Affected Software | Affected Version | How to fix |
|---|---|---|
| RAGFlow | =0.11.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2024-10131?
CVE-2024-10131 has been identified as a remote code execution (RCE) vulnerability, which is considered critical.
How do I fix CVE-2024-10131?
To fix CVE-2024-10131, update your Infiniflow Ragflow installation to a patched version that addresses this vulnerability.
What software is affected by CVE-2024-10131?
CVE-2024-10131 affects Infiniflow Ragflow version 0.11.0.
Is CVE-2024-10131 exploitable remotely?
Yes, CVE-2024-10131 can be exploited remotely due to how the `add_llm` function processes user input.
What are the potential impacts of CVE-2024-10131?
Exploitation of CVE-2024-10131 may allow an attacker to execute arbitrary code on the vulnerable system.
- agent/weakness
- agent/title
- agent/first-publish-date
- agent/description
- agent/references
- agent/type
- agent/author
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/severity
- agent/softwarecombine
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/infiniflow
- canonical/ragflow
- version/ragflow/0.11.0