CVE-2024-11821: Privilege Escalation in langgenius/dify
A privilege escalation vulnerability exists in langgenius/dify version 0.9.1. This vulnerability allows a normal user to modify Orchestrate instructions for a chatbot created by an admin user. The issue arises because the application does not properly enforce access controls on the endpoint /console/api/apps/{chatbot-id}/model-config, allowing unauthorized users to alter chatbot configurations.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update langgenius/dify to properly enforce access control on the endpoint /console/api/apps/{chatbot-id}/model-config, ensuring unauthorized users cannot alter chatbot model configuration (including Orchestrate instructions) for chatbots created by admin users.
langgenius/dify access controls for /console/api/apps/{chatbot-id}/model-config = enforce authorization checks so only the chatbot admin (creator/admin) can modify Orchestrate instructions
Event History
Frequently Asked Questions
What is the severity of CVE-2024-11821?
CVE-2024-11821 is classified as a privilege escalation vulnerability.
How do I fix CVE-2024-11821?
To fix CVE-2024-11821, ensure proper access controls are enforced in langgenius/dify version 0.9.1.
Who is affected by CVE-2024-11821?
CVE-2024-11821 affects users of langgenius/dify version 0.9.1, particularly those with normal user privileges.
What is the impact of exploiting CVE-2024-11821?
Exploiting CVE-2024-11821 allows normal users to modify Orchestrate instructions for an admin-created chatbot.
Is there an updated version of langgenius/dify that addresses CVE-2024-11821?
Check the official channels for langgenius/dify for any updated versions that address CVE-2024-11821.