Dify vulnerabilities

Dify version 1.14.1 and prior contain a path traversal vulnerability that allows authenticated users to manipulate requests forwarded to the Plugin Daemon's internal REST API. Attackers can exploit insufficient URL path sanitization to access internal endpoints.

Dify before version 1.14.2 contains an authorization bypass vulnerability that allows authenticated editor users to set and enable trace configurations for any application regardless of tenant ownership. This vulnerability allows attackers to redirect all messages and responses from victim applications to attacker-controlled LLM trace providers.

Dify v1.9.1 is vulnerable to Insecure Permissions. An unauthenticated attacker can send HTTP GET requests to the /console/api/system-features endpoint without credentials. The endpoint lacks proper authorization checks, allowing anonymous access to system configuration data. The maintainer states the endpoint is unauthenticated by design and does not expose sensitive data.

Dify up to version 1.5.1 includes default PostgreSQL credentials (username and password) in its docker-compose.yaml file. The vendor reports that PostgreSQL is not exposed on TCP port 5432 by default since version 1.0.1.

CORS misconfiguration vulnerability in Dify v1.9.1 in the /console/api/system-features endpoint. The endpoint reflects arbitrary Origin headers and sets Access-Control-Allow-Credentials: true, allowing any external domain to make authenticated cross-origin requests. NOTE: The supplier disputes this, arguing that credentialed requests do not provide additional access compared to unauthenticated requests.

Dify is an open-source LLM app development platform. Prior to 1.13.0, the /console/api/remote-files/upload endpoint in api/controllers/web/remote_files.py accepted an attacker-controlled URL without authentication and caused the Dify server to retrieve it. A remote attacker could use the endpoint to send requests to internal services or cloud metadata endpoints, potentially exposing sensitive data and using the server as a network pivot. This issue is fixed in version 1.13.0.

Dify, an open-source LLM app development platform, prior to 1.16.0, in the PUT /console/api/apps/<app_id>/server endpoint, did not verify that the MCP server belonged to the requested application and tenant. An authenticated workspace member could change another application's MCP server status and parameters, potentially redirecting data or disabling the service.

A security flaw in langgenius dify up to 1.14.2, affecting the jinja2.Template function in api/core/helper/code_executor/jinja2/jinja2_transformer.py of the Jinja2 Handler component, results in improper neutralization of special elements used in a template engine. The attack can be launched remotely, and the exploit is publicly available.

An Open Redirect vulnerability in Dify AI Workflow's AppInitializer component. An attacker can redirect a user to a malicious site during OAuth flow, requiring user interaction (visiting a malicious page or file).

A SQL injection vulnerability in Dify before version 1.16.0-rc1 in the MyScale vector store backend allows attackers to execute arbitrary SQL by supplying unsanitized search parameters to the search_by_full_text method without escaping or parameterization. Attackers can inject malicious SQL through the search parameters to read, modify, or delete data in the underlying ClickHouse database.

Dify before version 1.14.2 contains an authorization bypass vulnerability in the file preview endpoint that allows any authenticated user to read up to 3,000 characters of any uploaded document using only the file's UUID. Attackers can access the /console/api/files/{file_id}/preview endpoint to extract sensitive content from documents without ownership or workspace permission verification.

Dify before version 1.14.0 contains an authorization bypass vulnerability that allows authenticated users to read the full contents of files uploaded by other users within the same tenant by supplying an arbitrary file UUID in the chat-messages request.

Dify, an open-source LLM app development platform, prior to version 1.11.0 exposes the API key in plaintext to the frontend, allowing non-administrator users to view and reuse it. This can lead to unauthorized access to third-party services and quota consumption. Version 1.11.0 fixes the issue.

In Dify (version 1.8.1), a broken access control vulnerability was found on the /console/api/apps/<APP_ID>chat-messages endpoint. Users in the same workspace can read chat messages of other users if they know the conversation_id. The issue has been patched in version 1.9.0.

An XSS vulnerability exists in langgenius/dify versions prior to 1.1.3, specifically affecting Firefox browsers. This allows an attacker to obtain the administrator's token by sending a payload in the published chat; when the administrator views the conversation content through the monitoring/log function using Firefox, the XSS is triggered, potentially exposing sensitive token information.