PT-2025-12030 · Langgenius · Dify

Publicado 2025-03-20 · Atualizado 2025-03-20 · CVE-2024-10252

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions langgenius/dify versions <=v0.9.1

Description A vulnerability in the Dify sandbox service allows for code injection via internal SSRF requests. This enables an attacker to execute arbitrary Python code with root privileges within the sandbox environment, potentially leading to the deletion of the entire sandbox service and causing irreversible damage.

Recommendations For versions <=v0.9.1, update to a version that contains a fix for this issue, as using a version prior to or equal to v0.9.1 poses a significant risk. As a temporary workaround, consider restricting access to the Dify sandbox service to minimize the risk of exploitation.

Exploit

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2024-10252

Produtos afetados

Dify

Referências · 5

• 🔥 https://huntr.com/bounties/62c6c958-96cb-426c-aebc-c41f06b9d7b0 · Exploit
• https://github.com/langgenius/dify/commit/4ac99ffe0e1c9f4d7c523908e91bbc7739e0a8d4 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2024-10252 · Nota de Segurança
• https://twitter.com/CVEnew/status/1902671084555489495 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2024-10252 · Aviso do Fabricante