CVE-2024-12779
SSRF in infiniflow/ragflow
概要
SSRF in infiniflow/ragflow
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
A Server-Side Request Forgery (SSRF) vulnerability exists in infiniflow/ragflow version 0.12.0. The vulnerability is present in the POST /v1/llm/add_llm and POST /v1/conversation/tts endpoints. Attackers can specify an arbitrary URL as the api_base when adding an OPENAITTS model, and subsequently access the tts REST API endpoint to read contents from the specified URL. This can lead to unauthorized access to internal web resources.
参照URL
- advisory github.com
- advisory nvd.nist.gov
- web huntr.com