CVE-2024-12775

🗓️ 20 Mar 2025 10:09:23Reported by @huntr_aiType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 68 Views🌐 WEB

CVE-2024-12775 in langgenius/dify 0.10.1 allows SSRF via REST API test functionality.

Reporter	Title	Published	Views	Family All 8
CNNVD	dify 代码问题漏洞	20 Mar 202500:00	–	cnnvd
Cvelist	CVE-2024-12775 SSRF in langgenius/dify	20 Mar 202510:09	–	cvelist
Huntr	SSRF via Custom Tool Testing	25 Oct 202412:45	–	huntr
EUVD	EUVD-2025-7002	3 Oct 202520:07	–	euvd
NVD	CVE-2024-12775	20 Mar 202510:15	–	nvd
Positive Technologies	PT-2025-12145 · Unknown +1 · Langgenius/Dify +1	20 Mar 202500:00	–	ptsecurity
RedhatCVE	CVE-2024-12775	22 Mar 202513:15	–	redhatcve
Vulnrichment	CVE-2024-12775 SSRF in langgenius/dify	20 Mar 202510:09	–	vulnrichment

NVD

Node

langgenius difyMatch0.10.1node.js

[
  {
    "vendor": "langgenius",
    "product": "langgenius/dify",
    "versions": [
      {
        "version": "unspecified",
        "status": "affected",
        "versionType": "custom",
        "lessThanOrEqual": "latest"
      }
    ]
  }
]

Source	Link
huntr	www.huntr.com/bounties/e90e929a-9bc9-46ad-a5e5-1f6f124d0f12

Parameter	Position	Path	Description	CWE
servers	request body	/console/api/workspaces/current/tool-provider/api/test/pre	SSRF via arbitrary URL in servers.url allowing attacker to access internal resources using victim's credentials	CWE-918
url	request body	/console/api/workspaces/current/tool-provider/api/test/pre	SSRF via arbitrary URL in servers.url allowing attacker to access internal resources using victim's credentials	CWE-918

14 Jul 2025 18:13Current

6.6Medium risk

Vulners AI Score6.6

CVSS 36.5

EPSS0.00276

SSVC

CWE-918