CVE-2024-12779

Summary

CVE-2024-12779 is a Server-Side Request Forgery (SSRF) vulnerability affecting version 0.12.0 of infiniflow/ragflow. The issue is found in the `POST /v1/llm/add_llm` and `POST /v1/conversation/tts` endpoints. Malicious actors can exploit this vulnerability by specifying an arbitrary URL as the `api_base` when adding an `OPENAITTS` model. Consequently, attackers can gain unauthorized access to internal web resources by manipulating the `tts` REST API endpoint. This vulnerability poses a significant risk to systems utilizing infiniflow/ragflow and requires immediate attention and patching.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.