Description

A vulnerability in infiniflow/ragflow versions v0.12.0 allows for remote code execution. The RPC server in RagFlow uses a hard-coded AuthKey 'authkey=b'infiniflow-token4kevinhu'' which can be easily fetched by attackers to join the group communication without restrictions. Additionally, the server processes incoming data using pickle deserialization via `pickle.loads()` on `connection.recv()`, making it vulnerable to remote code execution. This issue is fixed in version 0.14.0.

INFO

Published Date :

2025-03-20T10:10:08.725Z

Last Modified :

2025-03-20T18:30:55.679Z

Source :

@huntr_ai
AFFECTED PRODUCTS

The following products are affected by CVE-2024-12433 vulnerability.

Vendors Products
Infiniflow
  • Ragflow
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2024-12433.

URL Resource
https://github.com/infiniflow/ragflow/commit/49494d4e3c8f06a5e52cf1f7cce9fa03cadcfbf6 cve-icon cve-icon
https://huntr.com/bounties/8a1465af-09e4-42af-9e54-0b70e7c87499 cve-icon cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact