CVE-2024-11822: Server-Side Request Forgery (SSRF) in langgenius/dify

Published Mar 20, 2025

Updated

langgenius/dify version 0.9.1 contains a Server-Side Request Forgery (SSRF) vulnerability. The vulnerability exists due to improper handling of the apiendpoint parameter, allowing an attacker to make direct requests to internal network services. This can lead to unauthorized access to internal servers and potentially expose sensitive information, including access to the AWS metadata endpoint.

Affected Software

2 affected components

LangGenius Dify

Dify dify=0.9.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade langgenius/dify to a version that resolves this vulnerability.
Fixed in 0.9.1

Event History

Mar 20, 2025

CVE Published

via MITRE·10:09 AM

Data Sourced

via MITRE·10:09 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·10:15 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2024-11822?

The severity of CVE-2024-11822 is significant due to its potential for exploiting internal network services.

How do I fix CVE-2024-11822?

To fix CVE-2024-11822, ensure proper validation and sanitization of the api_endpoint parameter in your application.

What impacts can occur from CVE-2024-11822?

CVE-2024-11822 can lead to unauthorized access to internal services, compromising system security.

Which versions of langgenius/dify are affected by CVE-2024-11822?

CVE-2024-11822 affects langgenius/dify version 0.9.1.

How can an attacker exploit CVE-2024-11822?

An attacker can exploit CVE-2024-11822 by crafting requests that manipulate the api_endpoint parameter to access internal services.