CVE-2024-11822: Server-Side Request Forgery (SSRF) in langgenius/dify

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-03-20 · updated 2026-06-17
Weakness: CWE-918

Description

langgenius/dify version 0.9.1 contains a Server-Side Request Forgery (SSRF) vulnerability. The vulnerability exists due to improper handling of the api_endpoint parameter, allowing an attacker to make direct requests to internal network services. This can lead to unauthorized access to internal servers and potentially expose sensitive information, including access to the AWS metadata endpoint.

Affected products

Dify: 0.9.1

References

https://huntr.com/bounties/f3042029-5d4e-41c6-850d-bbe02fae6592
https://huntr.com/bounties/f3042029-5d4e-41c6-850d-bbe02fae6592

Get alerted when CVE-2024-11822 or the next vulnerability affects your stack