CVE-2025-67732

Executive Summary

CVE-2025-67732 is a vulnerability in Dify, an open-source LLM app development platform, that exposes API keys in plaintext to the frontend. This allows non-administrator users to view and reuse these keys, potentially leading to unauthorized access to third-party services and consumption of limited quotas. The vulnerability affects versions prior to 1.11.0 and has been fixed in that release. The CVSS score is 0.0 due to incomplete data, but the actual risk is significant for organizations using Dify to manage LLM applications.

Supply Chain & Package Security

Dify is a Python-based application. The vulnerability lies in the backend API that serves configuration data to the frontend. The exposure of API keys in plaintext is a direct supply chain risk, as these keys may be used to access third-party LLM services (e.g., OpenAI, Anthropic) or other integrated services. An attacker with access to a non-administrator account can extract these keys and use them outside the Dify platform, potentially incurring costs or causing data breaches.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) - The vulnerability is exploitable over the network.
• Attack Complexity (AC): Low (L) - No special conditions are required.
• Privileges Required (PR): Low (L) - An attacker needs a non-administrator user account.
• User Interaction (UI): None (N) - No user interaction is required.
• Scope (S): Unchanged (U) - The impact is confined to the vulnerable component.
• Confidentiality (C): High (H) - API keys are exposed, leading to potential data access.
• Integrity (I): Low (L) - An attacker could modify configurations or use keys to alter data.
• Availability (A): None (N) - No direct impact on availability.

Threat Level: High. The exposure of API keys can lead to unauthorized access to third-party services, financial loss, and data breaches.

Deep Dive & Mechanics

The vulnerability stems from the Dify backend API that returns configuration data, including API keys, to the frontend. In versions prior to 1.11.0, the API endpoint that serves this data does not filter out sensitive information based on user roles. As a result, any authenticated user, regardless of their role (e.g., admin, editor, viewer), can retrieve the API keys in plaintext.

The affected endpoint is likely /api/workspaces/current or a similar endpoint that returns workspace configuration. The response includes fields such as api_key or provider_api_key that are not masked or omitted for non-admin users.

An attacker can:

1. Log in with a low-privilege account.
2. Send a GET request to the vulnerable endpoint.
3. Extract the API keys from the JSON response.
4. Use these keys to access third-party services (e.g., OpenAI, Anthropic) directly, bypassing Dify's access controls.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-1.11.0):

# Example of vulnerable endpoint
@app.route('/api/workspaces/current')
def get_workspace():
    workspace = get_current_workspace()
    return jsonify({
        'id': workspace.id,
        'name': workspace.name,
        'api_key': workspace.api_key,  # Exposed in plaintext
        'provider': workspace.provider
    })

Patched Code (1.11.0):

# Example of patched endpoint
@app.route('/api/workspaces/current')
def get_workspace():
    workspace = get_current_workspace()
    user = get_current_user()
    if user.role != 'admin':
        return jsonify({
            'id': workspace.id,
            'name': workspace.name,
            'api_key': '***MASKED***',  # Masked for non-admin users
            'provider': workspace.provider
        })
    return jsonify({
        'id': workspace.id,
        'name': workspace.name,
        'api_key': workspace.api_key,
        'provider': workspace.provider
    })

Exploitation & Lab Setup

Red Team

Prerequisites:

• A Dify instance running version < 1.11.0.
• A non-administrator user account (e.g., editor or viewer).

Exploitation Steps:

1. Log in to the Dify web interface with the low-privilege account.
2. Open the browser's Developer Tools (F12) and go to the Network tab.
3. Refresh the page or navigate to a workspace-related page.
4. Look for a request to /api/workspaces/current or similar.
5. Examine the response JSON for the api_key field.
6. Copy the API key and use it to access the third-party service directly.

Example using cURL:

# Step 1: Authenticate and get session cookie
curl -c cookies.txt -X POST https://dify.example.com/api/login \
  -H "Content-Type: application/json" \
  -d '{"email": "attacker@example.com", "password": "password123"}'

# Step 2: Fetch workspace configuration
curl -b cookies.txt https://dify.example.com/api/workspaces/current

# Step 3: Extract API key from response (e.g., using jq)
curl -b cookies.txt https://dify.example.com/api/workspaces/current | jq '.api_key'

Blue Team

Detection Steps:

1. Monitor API logs for requests to /api/workspaces/current from non-admin users.
2. Alert on any unusual usage of API keys outside the Dify platform (e.g., direct calls to OpenAI from unexpected IPs).
3. Review user activity logs for unauthorized access to sensitive endpoints.

Hunting Query:

-- Example SQL query for database logs
SELECT * FROM api_logs
WHERE endpoint = '/api/workspaces/current'
AND user_role != 'admin'
AND timestamp > NOW() - INTERVAL '7 days';

Indicators of Compromise (IOCs)

• Network IOCs:

  • Unusual API calls to third-party services (e.g., OpenAI, Anthropic) from IPs not associated with the Dify server.
  • Repeated requests to /api/workspaces/current from non-admin user accounts.

• File IOCs:

  • Log entries showing API key values in plaintext in response bodies.

• Behavioral IOCs:

  • Non-admin users accessing workspace configuration endpoints.
  • Sudden increase in API usage for third-party services.

Detection Engineering

YARA Rule

rule detect_dify_api_key_exposure {
    meta:
        description = "Detects Dify API key exposure in plaintext"
        author = "Valters IT"
        date = "2025-04-10"
        hash = "d41d8cd98f00b204e9800998ecf8427e"
    strings:
        $api_key = /"api_key"\s*:\s*"[A-Za-z0-9_-]{20,40}"/ 
        $provider = /"provider"\s*:\s*"[A-Za-z]+"/
    condition:
        all of them
}

Sigma Rule

title: Dify API Key Exposure Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to access Dify API keys in plaintext
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: nginx
detection:
    selection:
        http.method: GET
        http.url: '/api/workspaces/current'
        http.user_agent: '*'
    condition: selection
falsepositives:
    - Legitimate admin access
level: high

Suricata Rule

alert http any any -> any any (msg:"Dify API Key Exposure Attempt"; flow:to_server; http.method; content:"GET"; http.uri; content:"/api/workspaces/current"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Dify to version 1.11.0 or later.
2. Rotate all exposed API keys immediately.
3. Review third-party service logs for unauthorized usage.

Long-term Mitigations:

1. Implement role-based access control (RBAC) for all API endpoints.
2. Use environment variables or a secrets manager to store API keys.
3. Enable audit logging for all sensitive endpoint access.
4. Conduct regular security reviews of API responses.

Workarounds (if upgrade is not possible):

1. Use a reverse proxy (e.g., Nginx) to block access to /api/workspaces/current for non-admin users.
2. Implement a custom middleware to mask API keys in responses.

Valters IT
Securing Digital Frontiers