Dify v1.14.1 Path Traversal via Plugin Daemon Internal API Access
85Vexday Risk Score
Corrija agora. Ela exploração observada pelo VulnCheck e tem exploit funcional público.
ssvc Actcvss 9.3epss 1.9%
da publicação à arma
Publicada no NVD18 de mai.
VulnCheck+106d
probabilidade de exploração
1.9%top 21% das CVEs
exploração observada
simVulnCheck
2 exploit(s) público(s)
Dify version 1.14.1 and prior contain a path traversal vulnerability that allows authenticated users to manipulate requests forwarded to the Plugin Daemon's internal REST API by exploiting insufficient URL path sanitization. Attackers can traverse out of their authorized tenant path using unencoded dot sequences in task identifiers or manipulated filename parameters to access internal endpoints such as debug interfaces, requiring only knowledge of the victim tenant's UUID. NOTE: Dify Cloud allows unauthenticated free self-registration, making account creation trivially accessible to any attacker.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
Produtos afetados
langgenius · difyPoCs públicas encontradas — 2
cve_referencehuntr.com/bounties/35b7ad59-e35d-443f-bf77-387bfb932ec0não verificadocve_referencewww.zafran.io/resources/difytap-zafran-discovers-how-attackers-can-silently-wiretap-ai-data-across-tenants-on-a-platform-powering-1m-appsnão verificado⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
Referências
https://github.com/langgenius/dify/pull/35796https://huntr.com/bounties/35b7ad59-e35d-443f-bf77-387bfb932ec0https://www.vulncheck.com/advisories/dify-path-traversal-via-plugin-daemon-internal-api-accesshttps://www.zafran.io/resources/difytap-zafran-discovers-how-attackers-can-silently-wiretap-ai-data-across-tenants-on-a-platform-powering-1m-apps