CVE-2024-12779

Name of the Vulnerable Software and Affected Versions infiniflow/ragflow version 0.12.0

Description A Server-Side Request Forgery (SSRF) issue exists, allowing attackers to specify an arbitrary URL as the api base when adding an OPENAITTS model. This can lead to unauthorized access to internal web resources through the POST /v1/llm/add llm and POST /v1/conversation/tts endpoints.

Recommendations For infiniflow/ragflow version 0.12.0, as a temporary workaround, consider restricting access to the POST /v1/llm/add llm and POST /v1/conversation/tts endpoints until a patch is available. Avoid using the api base variable in the affected API endpoints to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.