Hamed Kohi

Dify before 1.15.0 contains a server-side request forgery vulnerability that allows any authenticated console user to bypass SSRF protections and issue arbitrary HTTP requests to internal services and cloud metadata endpoints due to the Squid proxy configuration only defining source ACLs without destination deny rules and the make request() helper performing no independent destination IP validation. Attackers can use endpoints such as GET /console/api/remote-files/<url>, POST /console/api/remote-files/upload, the HTTP Request workflow node, website crawl, or document import from URL to reach internal components like the sandbox, internal APIs, and PostgreSQL, and on AWS deployments read IAM credentials from the instance metadata service, with the HTTP Request node further enabling POST, PUT, and DELETE writes to internal services relying on network isolation for authorization.

An authenticated SQL injection exists in the Syndromic Surveillance module. Users with Clinician-level privileges can read and modify arbitrary database contents by submitting crafted values to the `form icd codes[]` POST parameter at the 'syndromicsurveillance/index' endpoint. The issue allows the use of an unquoted numeric IN() clause and UNION DISTINCT SELECT statement with hex-encoded literals to abuse the MySQL `extractvalue()` function for error-based exfiltration of bcrypt password hashes. Additionally, stacked queries can be executed to reset passwords, leading to full administrative account takeover.

Unauthenticated attackers can reuse expired password reset tokens by submitting them directly to the '/reset' endpoint. This occurs because the `SavePasswordController::handle()` method utilizes `PasswordToken::findOrFail()` without validating the token's expiration. Consequently, the 24-hour token lifetime, which is only enforced during form rendering, is bypassed, allowing an attacker to change any account password and obtain an authenticated session.

Improper session invalidation allows attackers with a valid session token to maintain full account access even after a password change. This occurs because the `access tokens` table is not cleared during password change events. Specifically, the `TokensClearer::clearPasswordTokens()` function only removes entries from the `password tokens` table, leaving active session cookies, API bearer tokens, and long-lived `RememberAccessToken` entries intact. Additionally, administrator-forced password resets performed via the user update endpoint fail to revoke these active sessions.

An IP spoofing issue exists that allows unauthenticated remote attackers to bypass rate-limiting controls on self-hosted instances. By manipulating the `X-Forwarded-For` header through a misconfigured Nginx configuration, attackers can use the `$proxy add x forwarded for` directive to append arbitrary values to the header chain and present a fake IP address.

The image proxy allows authenticated attackers to trigger internal HTTP requests by embedding attacker-controlled URLs in BBCode image tags. The proxy fetches these URLs without validating resolved destination IPs against loopback, link-local, or private address ranges. Attackers can use the automatic HMAC (Hash-based Message Authentication Code) signature generation to create valid signed proxy requests targeting internal services, including container network services, internal web applications, and cloud instance metadata endpoints.

A logic flaw exists that allows authenticated administrators to delete all built-in authorization groups. This occurs due to a type mismatch in the bulk delete protection check within the management views bulk AJAX endpoint. The system compares received JSON integer group IDs against string literals, which causes the protection check to always pass. This action destroys the forum's permission model and can render the site unusable.

An authorization bypass allows authenticated moderators to perform unauthorized actions on topics in forums they do not control. By submitting crafted topic ID lists in a batch request, an attacker can use a low-ID topic from a permitted forum as an anchor. This causes the permission check, which is only applied to the first result, to pass, enabling the execution of lock, unlock, delete, or hide actions against topics in unmoderated forums.

The Media module supports oEmbed, which utilizes two discovery mechanisms: `providers.json` and URL discovery. The URL discovery code can be exploited to trick the system into making unauthorized server-side requests to any arbitrary URL. This is a Server-Side Request Forgery (SSRF), a flaw where an attacker can force a server to send requests to an unintended location.

The unlisted question feature fails to enforce access restrictions on direct API endpoints. This allows authenticated users to discover and access unlisted questions, including their answers, comments, and revision history.

A stored cross-site scripting issue exists in the email template description field of the System and Server Status module. Low-privileged authenticated attackers can execute arbitrary commands by injecting unsanitized input into the 'save tmpl.cgi' endpoint, which is subsequently rendered without escaping in the 'list tmpls.cgi' endpoint.

An information disclosure issue exists in the cron controller that allows unauthenticated attackers to retrieve the application's secret cron key. By accessing the cron controller without authentication, an attacker can obtain the exposed secret key from the response, which enables the triggering of scheduled task execution outside of the intended schedule.

An unauthenticated reflected cross-site scripting issue exists in the visual editor preview renderer. Attackers can execute arbitrary JavaScript by manipulating the `r` query parameter and ` component ajax` POST parameter. This occurs because the `isEditor()` function does not perform session, role, or token verification, and the view handler injects raw HTML POST body content without sanitization. Attackers can use a malicious link or an auto-submitted form to execute controlled JavaScript within the context of the Vvveb origin.

The admin code editor allows authenticated users with low privileges, such as editor, author, contributor, or site admin roles, to execute arbitrary code. This is possible due to insufficient file extension restrictions, enabling attackers to write a malicious `.htaccess` file to map arbitrary extensions to the PHP handler. Subsequently, PHP code can be uploaded using those extensions to achieve remote code execution when the file is accessed via HTTP.

An information disclosure issue allows unauthenticated attackers to obtain sensitive server information by triggering unhandled exceptions in the password-reset module. By accessing the admin password-reset endpoint, a fatal error is triggered due to a missing namespace import. This exposes the absolute server file path, internal class namespaces, line numbers, and source code excerpts through the debug exception handler.

A hard-coded credentials issue exists in the `docker-compose-apache.yaml` configuration. This allows unauthenticated attackers to access the bundled phpMyAdmin container using pre-configured database credentials. By connecting to the phpMyAdmin port, attackers can obtain unrestricted read and write access to the entire database, including administrator password hashes, customer personally identifiable information, and order data, which can lead to account takeover and data manipulation.

An issue exists in the admin user profile save endpoint that allows authenticated users to modify privileged fields within their own profile. By injecting `role id=1` into the profile save requests, an attacker can escalate their privileges to Super Administrator. This escalation enables the use of plugin upload functionality, which can lead to remote code execution.

Authenticated users with media upload and rename permissions can execute arbitrary JavaScript by bypassing MIME type validation and renaming uploaded files to executable extensions. This is achieved by prepending a GIF89a header to HTML/JavaScript payloads to bypass upload validation and then renaming the file to a '.html' extension. This allows malicious scripts to execute in an administrator's browser session, potentially leading to the creation of backdoor accounts and the upload of malicious plugins for remote code execution.

An issue exists in the 'oEmbedProxy' action of the 'editor/editor' module where the `url` parameter is passed directly to the `getUrl()` function via curl without scheme or destination validation. Authenticated backend users can provide 'file://' URLs to read arbitrary files accessible by the web server process or 'http://' URLs targeting internal network addresses to probe internal services, with the response bodies returned to the caller. Server-Side Request Forgery (SSRF) is a flaw that allows an attacker to induce the server-side application to make requests to an unintended location.

The file management module in TYPO3's backend user interface allows the upload of any file type, with the exception of those that are directly executable in a web server context. This lack of restriction means it is possible to upload files that may be considered potentially harmful, such as executable binaries or files with inconsistent file extensions and MIME types. Although such files are not directly executable through the web server, their presence can introduce indirect risks, such as third-party services flagging or blocking access to the website for end users if suspicious files are found.