CVE-2024-12433: Remote Code Execution in infiniflow/ragflow
A vulnerability in infiniflow/ragflow versions v0.12.0 allows for remote code execution. The RPC server in RagFlow uses a hard-coded AuthKey 'authkey=b'infiniflow-token4kevinhu'' which can be easily fetched by attackers to join the group communication without restrictions. Additionally, the server processes incoming data using pickle deserialization via pickle.loads() on connection.recv(), making it vulnerable to remote code execution. This issue is fixed in version 0.14.0.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-12433?
CVE-2024-12433 has a high severity due to its potential for remote code execution.
How can I exploit CVE-2024-12433?
CVE-2024-12433 can be exploited by attackers who fetch the hard-coded AuthKey to gain unauthorized access.
What versions are affected by CVE-2024-12433?
CVE-2024-12433 affects RAGFlow versions from 0.12.0 to just below 0.14.0.
How do I fix CVE-2024-12433?
To fix CVE-2024-12433, update RAGFlow to the latest version that does not include the hard-coded AuthKey.
Is CVE-2024-12433 a zero-day vulnerability?
CVE-2024-12433 is not classified as a zero-day as it has been publicly disclosed.