← Back

CVE-2024-12775

nvd nist
Published: Mar 20, 2025Modified: Jul 14, 2025

JSON object

Loading...
6.5
Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Exploitability: 2.8 / Impact: 3.6
Source: security@huntr.dev (Secondary)

Description

langgenius/dify version 0.10.1 contains a Server-Side Request Forgery (SSRF) vulnerability in the test functionality for the Create Custom Tool option via the REST API `POST /console/api/workspaces/current/tool-provider/api/test/pre`. Attackers can set the `url` in the `servers` dictionary in OpenAI's schema with arbitrary URL targets, allowing them to abuse the victim server's credentials to access unauthorized web resources.

Affected (1)

Products: Langgenius: Dify
Langgenius
1 product
Dify
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Dify
Version 0.10.1

Related CWEs

CWE-918
Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

References (1)

Source: security@huntr.dev
ExploitThird Party Advisory

Timeline

No history available yet.