PT-2025-12111 · Langgenius · Dify

Published 2025-03-20 · Updated 2025-03-21 · CVE-2024-11822

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions langgenius/dify version 0.9.1

Description The issue is related to a Server-Side Request Forgery (SSRF) vulnerability. This vulnerability exists due to the improper handling of the api endpoint parameter, allowing an attacker to make direct requests to internal network services. This can lead to unauthorized access to internal servers and potentially expose sensitive information, including access to the AWS metadata endpoint.

Recommendations For version 0.9.1, consider restricting access to the api endpoint parameter to minimize the risk of exploitation. As a temporary workaround, avoid using the api endpoint parameter in sensitive operations until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2024-11822

Affected Products

Dify

References · 4

• 🔥 https://huntr.com/bounties/f3042029-5d4e-41c6-850d-bbe02fae6592 · Exploit
• https://osv.dev/vulnerability/CVE-2024-11822 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-11822 · Security Note
• https://twitter.com/CVEnew/status/1903016834963542030 · Twitter Post