CVE-2024-12450 RCE, Full Read SSRF, and Arbitrary File Read in infiniflow/ragflow

Medium 6.5 Published 20 Mar 2025 Updated 4 Apr 2025

Attackers can achieve remote code execution, read arbitrary files, and perform full-read SSRF via unfiltered URL parameters in the web crawl function.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2024-12450?

CVE-2024-12450 is a medium-severity server-side request forgery vulnerability in infiniflow/ragflow, published on 20 Mar 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

In infiniflow/ragflow versions 0.12.0, the `web_crawl` function in `document_app.py` contains multiple vulnerabilities. The function does not filter URL parameters, allowing attackers to exploit Full Read SSRF by accessing internal network addresses and viewing their content through the generated PDF files. Additionally, the lack of restrictions on the file protocol enables Arbitrary File Read, allowing attackers to read server files. Furthermore, the use of an outdated Chromium headless version with --no-sandbox mode enabled makes the application susceptible to Remote Code Execution (RCE) via known Chromium v8 vulnerabilities. These issues are resolved in version 0.14.0.

Weakness: CWE-918

Which versions are affected by CVE-2024-12450?

It affects 1 product.

Products include Infiniflow Ragflow.

How do I fix CVE-2024-12450?

No fix has been published for CVE-2024-12450 yet. Limit exposure of the affected software until one is available.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2024-12450 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-12450 exists.

Sources

Also known as GHSA-775f-24cq-qg6p.