CVE-2024-12775
MEDIUMlanggenius/dify 0.10.1 - Server-Side Request Forgery via Custom Tool Test API
Title source: llmDescription
langgenius/dify version 0.10.1 contains a Server-Side Request Forgery (SSRF) vulnerability in the test functionality for the Create Custom Tool option via the REST API `POST /console/api/workspaces/current/tool-provider/api/test/pre`. Attackers can set the `url` in the `servers` dictionary in OpenAI's schema with arbitrary URL targets, allowing them to abuse the victim server's credentials to access unauthorized web resources.
References (1)
Core 1
Core References
Exploit, Third Party Advisory
https://huntr.com/bounties/e90e929a-9bc9-46ad-a5e5-1f6f124d0f12
Scores
CVSS v3
6.5
EPSS
0.0061
EPSS Percentile
44.5%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
no
Technical Impact
partial
Details
CWE
CWE-918
Status
published
Products (1)
langgenius/dify
0.10.1
Published
Mar 20, 2025
Tracked Since
Feb 18, 2026