CVE-2024-12775: SSRF in langgenius/dify
langgenius/dify version 0.10.1 contains a Server-Side Request Forgery (SSRF) vulnerability in the test functionality for the Create Custom Tool option via the REST API POST /console/api/workspaces/current/tool-provider/api/test/pre. Attackers can set the url in the servers dictionary in OpenAI's schema with arbitrary URL targets, allowing them to abuse the victim server's credentials to access unauthorized web resources.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-12775?
CVE-2024-12775 is classified as a critical vulnerability due to its potential for exploitation via Server-Side Request Forgery.
How do I fix CVE-2024-12775?
To fix CVE-2024-12775, it is recommended to update to the latest version of langgenius/dify that addresses this vulnerability.
Who is affected by CVE-2024-12775?
CVE-2024-12775 affects all users of langgenius/dify version 0.10.1 utilizing the Create Custom Tool functionality via the REST API.
What type of vulnerability is CVE-2024-12775?
CVE-2024-12775 is a Server-Side Request Forgery (SSRF) vulnerability that allows attackers to control URL requests from the server.
What should I do if I am using an affected version of langgenius/dify?
If you are using langgenius/dify version 0.10.1, you should immediately update to a secure version to mitigate risks associated with CVE-2024-12775.