PT-2025-12148 · Unknown · Infiniflow/Ragflow

Published 2025-03-20 · Updated 2025-03-20 · CVE-2024-12779

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions infiniflow/ragflow version 0.12.0

Description A Server-Side Request Forgery (SSRF) issue exists, allowing attackers to specify an arbitrary URL as the api base when adding an OPENAITTS model. This can lead to unauthorized access to internal web resources through the POST /v1/llm/add llm and POST /v1/conversation/tts endpoints.

Recommendations For infiniflow/ragflow version 0.12.0, as a temporary workaround, consider restricting access to the POST /v1/llm/add llm and POST /v1/conversation/tts endpoints until a patch is available. Avoid using the api base variable in the affected API endpoints to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2024-12779

Affected Products

Infiniflow/Ragflow

References · 5

• 🔥 https://huntr.com/bounties/3cc748ba-2afb-4bfe-8553-10eb6d6dd4f0 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-12779 · Security Note
• https://osv.dev/vulnerability/CVE-2024-12779 · Vendor Advisory
• https://t.me/cvenotify/115465 · Telegram Post
• https://twitter.com/CVEnew/status/1902670981971521701 · Twitter Post