Stored Cross-Site Scripting Vulnerability in Infiniflow's Ragflow

CVE-2024-12870

What is CVE-2024-12870?

A stored cross-site scripting vulnerability has been identified in Infiniflow's Ragflow, allowing attackers to upload harmful HTML/XML files containing arbitrary JavaScript payloads. When a user accesses these files, their browser automatically renders the content due to the 'application/xml' content type, potentially executing malicious scripts in the user's session. This can result in unauthorized actions such as cookie theft and access to sensitive user data without requiring any form of authentication, making it a highly exploitable risk for users with network access to the affected instance.

References