CVE-2024-11822 Overview
CVE-2024-11822 is a Server-Side Request Forgery (SSRF) vulnerability affecting langgenius/dify version 0.9.1. The flaw stems from improper handling of the api_endpoint parameter, which allows an attacker to coerce the application into issuing arbitrary requests to internal network services. Successful exploitation can expose internal servers and sensitive metadata, including the AWS instance metadata endpoint. Dify is an open-source large language model (LLM) application development platform, so exposure of cloud credentials from the metadata service can escalate into broader cloud account compromise. The vulnerability is classified under CWE-918: Server-Side Request Forgery.
Critical Impact
Unauthenticated attackers can pivot into internal networks and retrieve AWS metadata, potentially obtaining IAM credentials tied to the Dify host.
Affected Products
- langgenius/dify version 0.9.1
- Deployments exposing the Dify API to untrusted users
- Dify instances hosted in cloud environments with instance metadata service (IMDSv1) enabled
Discovery Timeline
- 2025-03-20 - CVE-2024-11822 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-11822
Vulnerability Analysis
The vulnerability resides in Dify's handling of the api_endpoint parameter used when configuring or invoking external API integrations. The application accepts a user-supplied URL and issues server-side HTTP requests to it without adequately validating the destination host. Because Dify does not enforce an allowlist of external hosts or block requests to private and link-local address ranges, attackers can direct requests to internal services reachable from the Dify server.
On cloud-hosted deployments, the most immediate impact is access to http://169.254.169.254/, the AWS instance metadata endpoint. Where IMDSv1 is enabled, this exposes temporary IAM credentials associated with the EC2 instance role. Attackers can also enumerate internal HTTP services, databases with HTTP interfaces, and container orchestration APIs.
Root Cause
The root cause is missing destination validation on the api_endpoint parameter. The endpoint value is passed to the HTTP client without checks that reject private IPv4 ranges (RFC 1918), loopback addresses, link-local ranges such as 169.254.0.0/16, or DNS names that resolve into those ranges. No scheme restriction or redirect-following controls are applied either, which broadens the attack surface [CWE-918].
Attack Vector
Exploitation requires network access to the Dify API and the ability to submit a crafted api_endpoint value. The attacker supplies a URL pointing to an internal target, and the Dify server issues the request on their behalf and returns response data. On AWS, the attacker targets the metadata service to retrieve role credentials, then reuses those credentials against AWS APIs from an external location. Full technical details are available in the Huntr Bounty Listing.
Detection Methods for CVE-2024-11822
Indicators of Compromise
- Outbound HTTP requests from the Dify server to 169.254.169.254, 127.0.0.1, or RFC 1918 addresses that are not part of normal application traffic
- Access log entries showing api_endpoint values containing internal hostnames, IP literals, or URL-encoded metadata paths
- Unexpected use of AWS IAM role credentials from IP addresses outside the EC2 instance
Detection Strategies
- Inspect Dify application logs for api_endpoint parameter values and flag URLs that resolve to private, loopback, or link-local addresses
- Enable VPC Flow Logs and alert on Dify workloads initiating connections to the metadata service or internal service ports they do not normally contact
- Correlate AWS CloudTrail AssumeRole and API activity against the Dify instance role with the source IP address to identify credential theft
Monitoring Recommendations
- Forward Dify request logs and cloud audit logs to a centralized analytics platform for query and correlation
- Baseline outbound egress from Dify hosts and alert on new destinations, particularly link-local and internal ranges
- Monitor for anomalous AWS API calls made with the Dify instance role, such as credential enumeration or S3 listing from unexpected regions
How to Mitigate CVE-2024-11822
Immediate Actions Required
- Upgrade Dify to a version later than 0.9.1 that addresses the SSRF issue in api_endpoint handling
- Enforce IMDSv2 on all EC2 instances running Dify to require session tokens for metadata access
- Restrict outbound network access from Dify hosts to only the external services the application requires
Patch Information
Refer to the Huntr Bounty Listing for the fix reference and upgrade guidance from the langgenius/dify maintainers. Deploy the fixed release across all environments and rotate any IAM credentials associated with instance roles that may have been exposed.
Workarounds
- Place Dify behind an egress proxy that denies requests to private, loopback, and link-local address ranges
- Apply security group and network ACL rules that block outbound traffic from Dify to 169.254.169.254 and internal service subnets not required for operation
- Rotate AWS IAM role credentials attached to the Dify instance and audit CloudTrail for prior misuse
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
