Infiniflow Ragflow vulnerabilities

CVE-2024-12433 [CRITICAL] CWE-502 CVE-2024-12433: A vulnerability in infiniflow/ragflow versions v0.12.0 allows for remote code execution. The RPC ser A vulnerability in infiniflow/ragflow versions v0.12.0 allows for remote code execution. The RPC server in RagFlow uses a hard-coded AuthKey 'authkey=b'infiniflow-token4kevinhu'' which can be easily fetched by attackers to join the group communication without restrictions. Additionally, the server processes incoming data using pickle deserializati

CVE-2024-12450 [CRITICAL] CWE-918 CVE-2024-12450: In infiniflow/ragflow versions 0.12.0, the `web_crawl` function in `document_app.py` contains multip In infiniflow/ragflow versions 0.12.0, the `web_crawl` function in `document_app.py` contains multiple vulnerabilities. The function does not filter URL parameters, allowing attackers to exploit Full Read SSRF by accessing internal network addresses and viewing their content through the generated PDF files. Additionally, the lack of restrictions o

CVE-2024-10131 [HIGH] CWE-94 CVE-2024-10131: The `add_llm` function in `llm_app.py` in infiniflow/ragflow version 0.11.0 contains a remote code e The `add_llm` function in `llm_app.py` in infiniflow/ragflow version 0.11.0 contains a remote code execution (RCE) vulnerability. The function uses user-supplied input `req['llm_factory']` and `req['llm_name']` to dynamically instantiate classes from various model dictionaries. This approach allows an attacker to potentially execute arbitrary code due

CVE-2024-12779 [HIGH] CWE-918 CVE-2024-12779: A Server-Side Request Forgery (SSRF) vulnerability exists in infiniflow/ragflow version 0.12.0. The A Server-Side Request Forgery (SSRF) vulnerability exists in infiniflow/ragflow version 0.12.0. The vulnerability is present in the `POST /v1/llm/add_llm` and `POST /v1/conversation/tts` endpoints. Attackers can specify an arbitrary URL as the `api_base` when adding an `OPENAITTS` model, and subsequently access the `tts` REST API endpoint to read conte

CVE-2024-12880 [MEDIUM] CWE-639 CVE-2024-12880: A vulnerability in infiniflow/ragflow version RAGFlow-0.13.0 allows for partial account takeover via A vulnerability in infiniflow/ragflow version RAGFlow-0.13.0 allows for partial account takeover via insecure data querying. The issue arises from the way tenant IDs are handled in the application. If a user has access to multiple tenants, they can manipulate their tenant access to query and access API tokens of other tenants. This vulnerability aff

CVE-2024-12870 [MEDIUM] CWE-79 CVE-2024-12870: A stored cross-site scripting (XSS) vulnerability exists in infiniflow/ragflow, affecting the latest A stored cross-site scripting (XSS) vulnerability exists in infiniflow/ragflow, affecting the latest commit on the main branch (cec2080). The vulnerability allows an attacker to upload HTML/XML files that can host arbitrary JavaScript payloads. These files are served with the 'application/xml' content type, which is automatically rendered by browsers

CVE-2024-12871 [MEDIUM] CWE-79 CVE-2024-12871: An XSS vulnerability in infiniflow/ragflow version 0.12.0 allows an attacker to upload a malicious P An XSS vulnerability in infiniflow/ragflow version 0.12.0 allows an attacker to upload a malicious PDF file to the knowledge base. When the file is viewed within Ragflow, the payload is executed in the context of the user's browser. This can lead to session hijacking, data exfiltration, or unauthorized actions performed on behalf of the victim, compr

CVE-2024-12869 [MEDIUM] CWE-306 CVE-2024-12869: In infiniflow/ragflow version v0.12.0, there is an improper authentication vulnerability that allows In infiniflow/ragflow version v0.12.0, there is an improper authentication vulnerability that allows a user to view another user's invite list. This can lead to a privacy breach where users' personal or private information, such as email addresses or usernames in the invite list, could be exposed without their consent. This data leakage can facilita