CVE-2024-12433
Remote Code Execution in infiniflow/ragflow
Summary
Remote Code Execution in infiniflow/ragflow
Original description
The description as published by the source.
A vulnerability in infiniflow/ragflow versions v0.12.0 allows for remote code execution. The RPC server in RagFlow uses a hard-coded AuthKey 'authkey=b'infiniflow-token4kevinhu'' which can be easily fetched by attackers to join the group communication without restrictions. Additionally, the server processes incoming data using pickle deserialization via pickle.loads() on connection.recv(), making it vulnerable to remote code execution. This issue is fixed in version 0.14.0.
References
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- web huntr.com