CVE-2024-12775
SSRF in langgenius/dify
Résumé
SSRF in langgenius/dify
Description d'origine
La description telle que publiée par la source (souvent en anglais).
langgenius/dify version 0.10.1 contains a Server-Side Request Forgery (SSRF) vulnerability in the test functionality for the Create Custom Tool option via the REST API POST /console/api/workspaces/current/tool-provider/api/test/pre. Attackers can set the url in the servers dictionary in OpenAI's schema with arbitrary URL targets, allowing them to abuse the victim server's credentials to access unauthorized web resources.
Références
- advisory github.com
- advisory nvd.nist.gov
- web huntr.com