CVE-2024-12450: RCE, Full Read SSRF, and Arbitrary File Read in infiniflow/ragflow
First published: Thu Mar 20 2025(Updated: )
In infiniflow/ragflow versions 0.12.0, the `web_crawl` function in `document_app.py` contains multiple vulnerabilities. The function does not filter URL parameters, allowing attackers to exploit Full Read SSRF by accessing internal network addresses and viewing their content through the generated PDF files. Additionally, the lack of restrictions on the file protocol enables Arbitrary File Read, allowing attackers to read server files. Furthermore, the use of an outdated Chromium headless version with --no-sandbox mode enabled makes the application susceptible to Remote Code Execution (RCE) via known Chromium v8 vulnerabilities. These issues are resolved in version 0.14.0.
Credit: security@huntr.dev
| Affected Software | Affected Version | How to fix |
|---|---|---|
| RAGFlow | ||
| RAGFlow | =0.12.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-12450?
The severity of CVE-2024-12450 is high due to its potential for SSRF attacks, which can give unauthorized access to internal resources.
How do I fix CVE-2024-12450?
To fix CVE-2024-12450, update to the latest version of infiniflow/ragflow that addresses the vulnerabilities in the `web_crawl` function.
What are the consequences of exploiting CVE-2024-12450?
Exploiting CVE-2024-12450 can allow attackers to perform Full Read SSRF, leading to unauthorized access to internal network addresses and sensitive content.
Which versions of infiniflow/ragflow are affected by CVE-2024-12450?
CVE-2024-12450 affects infiniflow/ragflow version 0.12.0.
What is Full Read SSRF as related to CVE-2024-12450?
Full Read SSRF in the context of CVE-2024-12450 refers to the ability to read internal network resources by manipulating URL parameters.
- agent/references
- agent/title
- agent/weakness
- agent/type
- agent/first-publish-date
- agent/description
- agent/guess-ai
- agent/software-canonical-lookup
- agent/author
- agent/source
- agent/tags
- collector/mitre-cve
- source/MITRE
- agent/remedy
- agent/severity
- agent/last-modified-date
- agent/softwarecombine
- agent/event
- collector/nvd-api
- source/NVD
- vendor/infiniflow
- canonical/ragflow
- version/ragflow/0.12.0