CVE-2024-12775
SSRF in langgenius/dify
概要
SSRF in langgenius/dify
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
langgenius/dify version 0.10.1 contains a Server-Side Request Forgery (SSRF) vulnerability in the test functionality for the Create Custom Tool option via the REST API POST /console/api/workspaces/current/tool-provider/api/test/pre. Attackers can set the url in the servers dictionary in OpenAI's schema with arbitrary URL targets, allowing them to abuse the victim server's credentials to access unauthorized web resources.
参照URL
- advisory github.com
- advisory nvd.nist.gov
- web huntr.com