CVE-2024-10252 Overview
CVE-2024-10252 is a code injection vulnerability affecting langgenius/dify versions <=v0.9.1. The flaw resides in the Dify sandbox service and can be triggered through internal Server-Side Request Forgery (SSRF) requests. An attacker who reaches the sandbox endpoint can execute arbitrary Python code with root privileges inside the sandbox environment. Successful exploitation can lead to deletion of the sandbox service and irreversible damage to the affected deployment. The vulnerability is categorized under CWE-94: Improper Control of Generation of Code.
Critical Impact
Arbitrary Python code execution as root inside the Dify sandbox, enabling destruction of the sandbox service.
Affected Products
- langgenius/dify versions <=v0.9.1
- Dify sandbox service component
- Node.js-based Dify deployments (cpe:2.3:a:langgenius:dify:*:*:*:*:*:node.js:*:*)
Discovery Timeline
- 2025-03-20 - CVE-2024-10252 published to NVD
- 2026-06-17 - Last updated in NVD database
- Vendor fix - Commit 4ac99ffe merged to langgenius/dify
- Bounty disclosure - Reported via Huntr Bounty Submission
Technical Details for CVE-2024-10252
Vulnerability Analysis
Dify is an open-source LLM application development platform. The sandbox service is responsible for executing user-supplied Python code in an isolated environment. In versions <=v0.9.1, the sandbox exposes internal endpoints that trust requests originating from within the service network. An attacker with authenticated access can chain an internal SSRF primitive into a code-execution primitive against these endpoints. The injected Python payload runs as root inside the sandbox container, granting the attacker full control over the sandbox process and its filesystem. Because the sandbox holds root within its container, the attacker can remove binaries, configuration, and runtime state, permanently disabling the service.
Root Cause
The root cause is improper control of generated code combined with insufficient validation of internal request origins in the sandbox service. Internal HTTP calls reach code-executing routes without adequate authentication or input restrictions, allowing untrusted payloads to be interpreted as Python source.
Attack Vector
The attack is remote and network-based but requires high privileges to reach the vulnerable interface. An authenticated attacker crafts a request that causes an internal Dify component to issue an SSRF call to the sandbox executor. The payload contains Python code that the sandbox evaluates with root permissions. See the vendor commit and Huntr Bounty Submission for technical details on the request path and fix.
Detection Methods for CVE-2024-10252
Indicators of Compromise
- Unexpected outbound or internal HTTP requests from Dify application containers to the sandbox service on non-standard code-execution paths.
- Sandbox container logs showing Python execution of code not originating from a legitimate user workflow.
- Missing, truncated, or modified sandbox service binaries and configuration files after suspicious activity.
- Sudden sandbox service restarts, crashes, or unavailability following API activity from an authenticated user.
Detection Strategies
- Monitor Dify sandbox process telemetry for spawned interpreters running code with root UID inside the container.
- Alert on write, delete, or chmod operations against the sandbox service's own directories and binaries.
- Inspect internal service-to-service traffic for SSRF patterns targeting the sandbox executor endpoints.
Monitoring Recommendations
- Enable audit logging for all Dify API calls that trigger code execution and forward logs to a central SIEM.
- Baseline normal sandbox request volume and rate, then alert on anomalies from privileged accounts.
- Track version metadata for deployed Dify instances to flag any host still running <=v0.9.1.
How to Mitigate CVE-2024-10252
Immediate Actions Required
- Upgrade langgenius/dify to a version that includes commit 4ac99ffe0e1c9f4d7c523908e91bbc7739e0a8d4.
- Restrict administrative and high-privilege access to the Dify control plane while patching is scheduled.
- Isolate the sandbox service on a dedicated network segment that only accepts traffic from vetted internal components.
- Review sandbox and application logs for prior exploitation attempts against code-execution routes.
Patch Information
The upstream fix is available in the langgenius/dify repository via commit 4ac99ffe. Operators running v0.9.1 or earlier should upgrade to a release that incorporates this commit. Rebuild and redeploy sandbox container images after the upgrade to ensure the patched code is loaded.
Workarounds
- Drop the container root capability set for the sandbox service and run it as a non-root user where the deployment supports it.
- Apply network policies (for example, Kubernetes NetworkPolicy) that deny sandbox ingress from any source other than the Dify API service.
- Disable or gate any Dify features that expose direct code-execution paths until the patched version is deployed.
- Enforce strict authentication and rate limits on all internal service endpoints to reduce SSRF pivoting opportunities.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
