Vulnerability · Published Mar 20, 2025 · Assigned by @huntr_ai

CVE-2024-11822Server-Side Request Forgery (SSRF) in langgenius/dify

Medium 6.5

In plain English

A medium-severity server-side request forgery in langgenius/dify from langgenius. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities).

Severity (CVSS 3.0)6.5Medium

Exploit odds (30 days)0.6%top 50.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

langgenius/dify version 0.9.1 contains a Server-Side Request Forgery (SSRF) vulnerability. The vulnerability exists due to improper handling of the api_endpoint parameter, allowing an attacker to make direct requests to internal network services. This can lead to unauthorized access to internal servers and potentially expose sensitive information, including access to the AWS metadata endpoint.

Affected products (as reported)

Vendor	Product	Versions
langgenius	langgenius/dify	unspecified – through latest

Weakness: CWE-918 · Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

https://huntr.com/bounties/f3042029-5d4e-41c6-850d-bbe02fae6592