CVE-2024-12779
SSRF in infiniflow/ragflow
Résumé
SSRF in infiniflow/ragflow
Description d'origine
La description telle que publiée par la source (souvent en anglais).
A Server-Side Request Forgery (SSRF) vulnerability exists in infiniflow/ragflow version 0.12.0. The vulnerability is present in the POST /v1/llm/add_llm and POST /v1/conversation/tts endpoints. Attackers can specify an arbitrary URL as the api_base when adding an OPENAITTS model, and subsequently access the tts REST API endpoint to read contents from the specified URL. This can lead to unauthorized access to internal web resources.
Références
- advisory github.com
- advisory nvd.nist.gov
- web huntr.com