CVE-2024-12433
Remote Code Execution in infiniflow/ragflow
Résumé
Remote Code Execution in infiniflow/ragflow
Description d'origine
La description telle que publiée par la source (souvent en anglais).
A vulnerability in infiniflow/ragflow versions v0.12.0 allows for remote code execution. The RPC server in RagFlow uses a hard-coded AuthKey 'authkey=b'infiniflow-token4kevinhu'' which can be easily fetched by attackers to join the group communication without restrictions. Additionally, the server processes incoming data using pickle deserialization via pickle.loads() on connection.recv(), making it vulnerable to remote code execution. This issue is fixed in version 0.14.0.
Références
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- web huntr.com