CyberRota Analysis
AI-GeneratedThe Dify open-source LLM app development platform prior to version 1.13.0 contains a vulnerability in the /console/api/remote-files/upload endpoint, which allows unauthenticated remote attackers to upload files via attacker-controlled URLs. This could lead to unauthorized access to internal services or cloud metadata, potentially exposing sensitive data and enabling further network exploitation. Organizations using affected versions should prioritize upgrading to version 1.13.0 to mitigate these risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Dify is an open-source LLM app development platform. Prior to 1.13.0, the /console/api/remote-files/upload endpoint in api/controllers/web/remote_files.py accepted an attacker-controlled URL without authentication and caused the Dify server to retrieve it. A remote attacker could use the endpoint to send requests to internal services or cloud metadata endpoints, potentially exposing sensitive data and using the server as a network pivot. This issue is fixed in version 1.13.0.