Multiple Vulnerabilities in Infiniflow Ragflow Affecting Internal Network Security

CVE-2024-12450

What is CVE-2024-12450?

The web_crawl function in Infiniflow's Ragflow version 0.12.0 is exposed to critical security issues. It fails to filter URL parameters, enabling attackers to exploit Server-Side Request Forgery (SSRF) vulnerabilities. This flaw permits access to internal network resources that should be secured, leaking sensitive data through generated PDF files. Additionally, the application lacks restrictions on file protocols, which can result in Arbitrary File Read vulnerabilities, allowing unauthorized file access on the server. Compounding these security issues is the deployment of an outdated Chromium headless version operating in --no-sandbox mode, which heightens the risk of Remote Code Execution (RCE) through known vulnerabilities in Chromium's v8 engine. Users are advised to upgrade to version 0.14.0 where these vulnerabilities have been addressed.

References