CVE-2024-10131: Infiniflow Ragflow RCE Vulnerability

CVE-2024-10131 Overview

CVE-2024-10131 is a remote code execution (RCE) vulnerability in Infiniflow RAGFlow version 0.11.0. The flaw resides in the add_llm function in llm_app.py, which dynamically instantiates classes from model dictionaries using unvalidated user input. Attackers can supply crafted values for req['llm_factory'] and req['llm_name'] to execute arbitrary code on the server. The issue is classified under [CWE-94] (Improper Control of Generation of Code).

Critical Impact
Authenticated attackers can achieve remote code execution on RAGFlow servers by manipulating LLM factory parameters, resulting in full compromise of confidentiality, integrity, and availability.

Affected Products

Infiniflow RAGFlow 0.11.0
Deployments exposing the add_llm API endpoint
Self-hosted RAGFlow instances accessible over the network

Discovery Timeline

2024-10-19 - CVE-2024-10131 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-10131

Vulnerability Analysis

RAGFlow is an open-source retrieval-augmented generation (RAG) engine built by Infiniflow. The add_llm function accepts JSON input describing an LLM provider and model to register. The function uses req['llm_factory'] and req['llm_name'] as keys into internal model dictionaries and instantiates the resulting class directly. Because the input is not validated against an allow list, attackers can reference arbitrary dictionary entries that trigger unintended class instantiation. The instantiated object executes attacker-controlled logic within the RAGFlow process context.

An authenticated attacker with low privileges can reach the vulnerable endpoint over the network and obtain code execution without user interaction. Successful exploitation grants access to the RAGFlow application data, connected model APIs, and any credentials stored on the host.

Root Cause

The root cause is missing input validation on user-controlled dictionary keys used for dynamic class instantiation. The add_llm function trusts the client to supply legitimate llm_factory and llm_name values. No allow list, type check, or sanitization gates the lookup. This design permits an attacker to force instantiation of unintended classes and pass attacker-controlled constructor arguments.

Attack Vector

Exploitation requires network access to the RAGFlow API and a valid low-privilege account. The attacker submits a POST request to the add_llm endpoint with a malicious llm_factory value. When RAGFlow uses the value as an index into its model dictionaries, the referenced class is instantiated with attacker-supplied parameters. The resulting code runs with the privileges of the RAGFlow application process. See the Huntr Bounty Report for technical details of the disclosed proof of concept.

Detection Methods for CVE-2024-10131

Indicators of Compromise

Unexpected POST requests to the add_llm endpoint containing unusual llm_factory or llm_name values
Child processes spawned by the RAGFlow Python process, particularly shells or network utilities
Outbound network connections from the RAGFlow host to unfamiliar destinations following API activity
New or modified files under the RAGFlow application directory not tied to a deployment

Detection Strategies

Inspect API access logs for add_llm calls originating from unexpected accounts or IP addresses
Correlate authentication events with subsequent LLM configuration changes to identify anomalous sequences
Deploy runtime monitoring on the RAGFlow host to alert on process execution anomalies from the Python interpreter

Monitoring Recommendations

Enable verbose application logging for all administrative RAGFlow endpoints
Forward host and application logs to a centralized analytics platform for retention and correlation
Establish behavioral baselines for the RAGFlow service process and alert on deviations such as new child processes or unusual network egress

How to Mitigate CVE-2024-10131

Immediate Actions Required

Upgrade RAGFlow to a version later than 0.11.0 that contains a fix for the add_llm input validation
Restrict network access to the RAGFlow API to trusted administrators using firewall rules or reverse proxy access controls
Rotate credentials, API keys, and model provider tokens stored in RAGFlow if exploitation is suspected
Audit user accounts and remove unused low-privilege accounts that could reach the vulnerable endpoint

Patch Information

No vendor advisory URL is listed in the NVD record. Users should track the Infiniflow RAGFlow project for releases addressing this issue and reference the Huntr Bounty Report for disclosure details.

Workarounds

Place RAGFlow behind an authenticating reverse proxy that restricts the add_llm endpoint to administrators
Run RAGFlow as an unprivileged user in an isolated container with restricted egress and read-only filesystems where possible
Monitor and alert on any invocation of the add_llm endpoint until an upstream patch is applied

bash

# Example: restrict access to the RAGFlow add_llm endpoint at an nginx reverse proxy
location /v1/llm/add_llm {
    allow 10.0.0.0/24;   # admin subnet only
    deny all;
    proxy_pass http://ragflow_backend;
}