CVE-2024-12433 Information

Description

A vulnerability in infiniflow/ragflow versions v0.12.0 allows for remote code execution. The RPC server in RagFlow uses a hard-coded AuthKey ‘authkey=b’infiniflow-token4kevinhu’’ which can be easily fetched by attackers to join the group communication without restrictions. Additionally the server processes incoming data using pickle deserialization via pickle.loads() on connection.recv() making it vulnerable to remote code execution. This issue is fixed in version 0.14.0.

Reference

https://github.com/infiniflow/ragflow/commit/49494d4e3c8f06a5e52cf1f7cce9fa03cadcfbf6 https://huntr.com/bounties/8a1465af-09e4-42af-9e54-0b70e7c87499