CVE-2024-53450

Executive Summary

CVE-2024-53450 is an improper access control vulnerability in RAGFlow version 0.13.0, specifically within the document-hooks.ts file. This flaw allows an unauthenticated or low-privileged attacker to access user documents without proper authorization. The vulnerability stems from missing or insufficient access control checks on document-related API endpoints, potentially exposing sensitive data stored within the RAGFlow system. As of this report, no official patch has been released, and the CVSS score is listed as 0.0, indicating incomplete scoring data. The EPSS score is 0.0%, suggesting low exploitation activity in the wild, but the risk remains significant due to the potential for data leakage.

Supply Chain & Package Security

RAGFlow is an open-source retrieval-augmented generation (RAG) platform. The vulnerability resides in the core application code, not in a third-party package. However, organizations using RAGFlow should verify their deployment version and monitor for updates. No known supply chain compromise has been reported.

CVSS Breakdown & Threat Level

The CVSS score is currently listed as 0.0, which is likely a placeholder or incomplete data. Based on the vulnerability description, a reasonable assessment would be:

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component is the only one affected.
• Confidentiality (C): High (H) – Sensitive documents can be accessed.
• Integrity (I): None (N) – No modification of data.
• Availability (A): None (N) – No impact on availability.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Estimated Base Score: 7.5 (High)

Threat Level: High – Unauthorized access to documents can lead to data breaches and compliance violations.

Deep Dive & Mechanics

The vulnerability is located in the document-hooks.ts file, which likely handles API hooks for document operations (e.g., listing, viewing, downloading). The improper access control means that the application fails to verify whether the requesting user has the necessary permissions to access a specific document. This could be due to:

• Missing authentication checks on certain endpoints.
• Incorrect role-based access control (RBAC) logic.
• Insecure direct object references (IDOR) where document IDs are not validated against the user's ownership or group membership.

An attacker can exploit this by sending crafted HTTP requests to the vulnerable endpoints, potentially enumerating document IDs or accessing documents without authorization.

Vulnerable vs. Patched Code

Since no patch is available, a comparison cannot be made. However, a secure implementation would include:

• Vulnerable Code (hypothetical):

  // document-hooks.ts
  app.get('/api/documents/:id', async (req, res) => {
    const doc = await Document.findById(req.params.id);
    res.json(doc);
  });
  

• Patched Code (hypothetical):

  // document-hooks.ts
  app.get('/api/documents/:id', authenticate, async (req, res) => {
    const doc = await Document.findById(req.params.id);
    if (!doc || doc.userId !== req.user.id) {
      return res.status(403).json({ error: 'Forbidden' });
    }
    res.json(doc);
  });
  

The patched version adds authentication (authenticate middleware) and checks that the document belongs to the requesting user.

Exploitation & Lab Setup

Red Team

1. Reconnaissance: Identify RAGFlow instances using Shodan dorks: "RAGFlow" or "RAGFlow 0.13.0".

2. Endpoint Discovery: Probe for document-related endpoints, e.g., /api/documents, /api/documents/{id}, /api/document-hooks.

3. Exploitation:

   • Send a GET request to /api/documents/1 without authentication headers.
   • If successful, iterate through document IDs (e.g., 1, 2, 3, ...) to enumerate accessible documents.
   • Use tools like curl or Burp Suite to automate the process.

   curl -X GET http://target:port/api/documents/1
   

4. Data Exfiltration: Download or view the contents of exposed documents.

Blue Team

1. Detection: Monitor for unusual access patterns to document endpoints, especially from unauthenticated sources.
2. Honeypot: Deploy fake documents with unique identifiers to detect unauthorized access.
3. Mitigation: Implement a Web Application Firewall (WAF) rule to block requests to /api/documents/ without valid authentication tokens.
4. Logging: Enable detailed logging for all document access attempts and review logs for anomalies.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Unusual HTTP requests to /api/documents/ or /api/document-hooks without authentication headers.
  • High volume of requests to sequential document IDs (e.g., /api/documents/1, /api/documents/2, ...).
• File IOCs:
  • Log entries showing 403 Forbidden or 200 OK responses for document endpoints from unknown IPs.
• System IOCs:
  • Unexpected access to document storage directories or databases.

Detection Engineering

YARA Rule

rule CVE_2024_53450_RAGFlow_Access_Control {
  meta:
    description = "Detects exploitation attempts of CVE-2024-53450 in RAGFlow"
    author = "Valters IT"
    date = "2025-04-10"
    hash = "unknown"
  strings:
    $s1 = "/api/documents/" ascii wide nocase
    $s2 = "/api/document-hooks" ascii wide nocase
    $s3 = "GET" ascii wide nocase
  condition:
    all of them
}

Sigma Rule

title: CVE-2024-53450 RAGFlow Unauthorized Document Access
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects unauthorized access attempts to RAGFlow document endpoints
author: Valters IT
date: 2025-04-10
logsource:
  category: webserver
  product: apache
  service: access_log
detection:
  selection:
    cs-method: 'GET'
    cs-uri-stem:
      - '/api/documents/*'
      - '/api/document-hooks'
    sc-status: 200
  condition: selection
falsepositives:
  - Legitimate authenticated users
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-53450 RAGFlow Unauthorized Document Access"; flow:to_server; content:"GET"; http_method; content:"/api/documents/"; http_uri; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Actions:

   • Restrict network access to the RAGFlow instance using a firewall or VPN.
   • Implement authentication for all document-related endpoints.
   • Apply the principle of least privilege for user roles.

2. Long-term Fix:

   • Monitor the RAGFlow repository for an official patch.
   • If possible, apply a custom patch to document-hooks.ts to enforce access control.
   • Conduct a security audit of the entire application.

3. Workarounds:

   • Use a reverse proxy (e.g., Nginx) to add authentication headers before requests reach the application.
   • Disable the vulnerable endpoints if not required.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert