CVE-2024-12450

Public Exploit
RCE, Full Read SSRF, and Arbitrary File Read in infiniflow/ragflow

Description

In infiniflow/ragflow versions 0.12.0, the `web_crawl` function in `document_app.py` contains multiple vulnerabilities. The function does not filter URL parameters, allowing attackers to exploit Full Read SSRF by accessing internal network addresses and viewing their content through the generated PDF files. Additionally, the lack of restrictions on the file protocol enables Arbitrary File Read, allowing attackers to read server files. Furthermore, the use of an outdated Chromium headless version with --no-sandbox mode enabled makes the application susceptible to Remote Code Execution (RCE) via known Chromium v8 vulnerabilities. These issues are resolved in version 0.14.0.

Category

9.8
CVSS
Severity: Critical
CVSS 3.1 •
CVSS 3.0 •
EPSS 0.11%
Affected: infiniflow infiniflow/ragflow
Published at:
Updated at:

References

Link Tags
https://huntr.com/bounties/da06360c-87c3-4ba9-be67-29f6eff9d44a exploit
https://github.com/infiniflow/ragflow/commit/3faae0b2c2f8a26233ee1442ba04874b3406f6e9 patch

Frequently Asked Questions

What is the severity of CVE-2024-12450?
CVE-2024-12450 has been scored as a critical severity vulnerability.
How to fix CVE-2024-12450?
To fix CVE-2024-12450, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2024-12450 being actively exploited in the wild?
It is possible that CVE-2024-12450 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2024-12450?
CVE-2024-12450 affects infiniflow infiniflow/ragflow.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.