CVE-2025-32796

Executive Summary

CVE-2025-32796 is an access control vulnerability in Dify, an open-source LLM app development platform. The flaw allows authenticated non-admin users to enable or disable applications via the API, even though the web UI restricts this action to administrators. This unauthorized modification can disrupt application availability and functionality. The vulnerability has been patched in version 0.6.12. The EPSS score is 0.0%, indicating low exploitation likelihood currently, but the risk remains for unpatched instances.

Supply Chain & Package Security

Dify is distributed as a Python/Docker-based platform. The vulnerability is in the application’s own API access control logic, not in a third-party package. However, organizations should verify the integrity of their Dify installation and ensure they are using the official Docker images or source from the Dify GitHub repository.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (authenticated user)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low (unauthorized enable/disable)
• Availability Impact: High (can disable apps, causing denial of service)

Threat Level: Medium. The vulnerability requires authentication but allows a low-privilege user to impact availability of applications.

Deep Dive & Mechanics

The vulnerability stems from improper enforcement of role-based access controls (RBAC) in the Dify API. The web UI correctly disables the enable/disable button for non-admin users, but the underlying API endpoint does not validate the user’s role before processing the request. This allows a normal user to send a direct API call to toggle the status of an application.

Root Cause: Missing authorization check in the API handler for enabling/disabling apps. The code likely checks for authentication but not for admin privileges.

Attack Vector: An authenticated user with a valid session token or API key can send a POST/PUT request to the vulnerable endpoint (e.g., /api/apps/{id}/toggle) with a payload indicating the desired state.

Impact: An attacker can disable critical applications, causing denial of service. They could also re-enable apps, but the primary risk is availability disruption.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-0.6.12):

# Example vulnerable handler
@app.route('/api/apps/<app_id>/toggle', methods=['POST'])
@login_required
def toggle_app(app_id):
    app = App.query.get(app_id)
    if not app:
        return jsonify({'error': 'App not found'}), 404
    # Missing admin check
    app.enabled = not app.enabled
    db.session.commit()
    return jsonify({'status': 'success'})

Patched Code (0.6.12):

# Example patched handler
@app.route('/api/apps/<app_id>/toggle', methods=['POST'])
@login_required
@admin_required  # New decorator
def toggle_app(app_id):
    app = App.query.get(app_id)
    if not app:
        return jsonify({'error': 'App not found'}), 404
    app.enabled = not app.enabled
    db.session.commit()
    return jsonify({'status': 'success'})

The patch adds an @admin_required decorator (or equivalent check) to ensure only users with admin privileges can toggle app status.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Valid user credentials (non-admin) on a Dify instance < 0.6.12.
• Network access to the Dify API endpoint.

Exploitation Steps:

1. Obtain a session cookie or API token for a normal user.
2. Identify the target app ID (e.g., via /api/apps endpoint).
3. Send a POST request to toggle the app status:

   curl -X POST https://target.dify.com/api/apps/123/toggle \
     -H "Authorization: Bearer <user_token>" \
     -H "Content-Type: application/json" \
     -d '{"enabled": false}'
   

4. Verify the app is disabled by checking the UI or API.

Note: No public exploit code is available, but the attack is straightforward.

Blue Team

Detection:

• Monitor API logs for unauthorized toggle requests from non-admin users.
• Alert on repeated failed attempts to access admin-only endpoints.
• Use the Sigma rule below to detect anomalous API calls.

Hunting:

• Search for HTTP requests to /api/apps/*/toggle with a non-admin user context.
• Correlate with user role changes or privilege escalation attempts.

Prevention:

• Apply the patch immediately.
• Implement network segmentation to limit API access.
• Use a WAF to block requests to sensitive endpoints from non-admin IPs.

Indicators of Compromise (IOCs)

• Network: HTTP POST requests to /api/apps/*/toggle from non-admin users.
• Logs: Application logs showing toggle_app called by a user with role != admin.
• System: Unexpected enable/disable of applications without admin action.

Detection Engineering

YARA Rule

rule detect_dify_toggle_exploit {
    meta:
        description = "Detects attempts to exploit CVE-2025-32796 by looking for toggle requests in Dify logs"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-32796"
    strings:
        $toggle = "/api/apps/" nocase
        $action = "toggle" nocase
        $method = "POST" nocase
    condition:
        all of them
}

Sigma Rule

title: Dify Unauthorized App Toggle Attempt
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects non-admin users attempting to toggle app status via Dify API
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: nginx
detection:
    selection:
        http.method: 'POST'
        http.url: '/api/apps/*/toggle'
        http.user_agent: '*'
    condition: selection
falsepositives:
    - Legitimate admin actions (filter by user role if available)
level: medium

Suricata Rule

alert http any any -> any any (
    msg:"CVE-2025-32796 Dify Unauthorized App Toggle Attempt";
    flow:to_server;
    http.method; content:"POST";
    http.uri; content:"/api/apps/"; distance:0; within:100;
    http.uri; content:"/toggle"; distance:0; within:100;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate:

• Upgrade Dify to version 0.6.12 or later.
• If upgrade is not possible, implement a WAF rule to block POST requests to /api/apps/*/toggle from non-admin IPs.

Long-term:

• Enforce RBAC at the API gateway level.
• Conduct a security audit of all API endpoints for similar flaws.
• Implement logging and monitoring for all admin-level actions.

Workaround:

• Modify the API access control to check user role before processing toggle requests (as described in the advisory).

Valters IT
DevSecOps & Cyber Threat Intelligence