Vulnerability · Published Oct 19, 2024 · Assigned by @huntr_ai
CVE-2024-10131Remote Code Execution in infiniflow/ragflow
High 8.8
In plain English
A high-severity code injection in infiniflow/ragflow from infiniflow. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 67% of all known vulnerabilities).
Official description
The `add_llm` function in `llm_app.py` in infiniflow/ragflow version 0.11.0 contains a remote code execution (RCE) vulnerability. The function uses user-supplied input `req['llm_factory']` and `req['llm_name']` to dynamically instantiate classes from various model dictionaries. This approach allows an attacker to potentially execute arbitrary code due to the lack of comprehensive input validation or sanitization. An attacker could provide a malicious value for 'llm_factory' that, when used as an index to these model dictionaries, results in the execution of arbitrary code.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| infiniflow | infiniflow/ragflow | unspecified – through latest |
Weakness: CWE-94 · Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H