CVE-2024-12775
SSRF in langgenius/dify
Summary
SSRF in langgenius/dify
Original description
The description as published by the source.
langgenius/dify version 0.10.1 contains a Server-Side Request Forgery (SSRF) vulnerability in the test functionality for the Create Custom Tool option via the REST API POST /console/api/workspaces/current/tool-provider/api/test/pre. Attackers can set the url in the servers dictionary in OpenAI's schema with arbitrary URL targets, allowing them to abuse the victim server's credentials to access unauthorized web resources.
References
- advisory github.com
- advisory nvd.nist.gov
- web huntr.com