CVE-2024-11824: Langgenius Dify Stored XSS Vulnerability

CVE-2024-11824 Overview

CVE-2024-11824 is a stored cross-site scripting (XSS) vulnerability in langgenius/dify, an open-source large language model (LLM) application development platform. The flaw resides in the chat log functionality, where the application fails to disallow HTML tags such as <input> and <form>. An attacker with low privileges can inject malicious HTML through prompts, which is then persisted in the chat log. When an administrator later views the log, the injected markup renders in the admin's browser context. This can be leveraged to steal administrator credentials or exfiltrate sensitive session data. The issue is tracked under [CWE-79] and is fixed in Dify version 0.12.1.

Critical Impact
Stored HTML injection in chat logs enables credential theft and session hijacking against Dify administrators who review attacker-controlled prompts.

Affected Products

Langgenius Dify (Node.js distribution) prior to version 0.12.1
Dify chat log viewer (web/app/components/base/markdown-blocks/form.tsx)
Self-hosted Dify deployments exposing chat logs to administrators

Discovery Timeline

2025-03-20 - CVE-2024-11824 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database
Vendor fix - Patched in Dify 0.12.1 via commit 55edd50
Bounty disclosure - Reported through Huntr Bounty Program

Technical Details for CVE-2024-11824

Vulnerability Analysis

The vulnerability is a stored XSS issue in the Dify chat log rendering path. Dify accepts user prompts as input to LLM workflows and preserves them in chat logs for administrative review. The markdown rendering pipeline in web/app/components/base/markdown-blocks/form.tsx does not enforce a strict allowlist of permitted HTML elements. Interactive form elements such as <input>, <form>, <textarea>, and <button> pass through the sanitizer and render inside the administrator's authenticated session. An attacker who can submit prompts to the target Dify instance can therefore plant HTML payloads that execute when a privileged user opens the log. The user interaction requirement is satisfied by the routine administrative task of reviewing logs, and the scope change reflects the shift from a low-privileged prompt submitter to the admin's session context.

Root Cause

The root cause is missing output sanitization on chat log content that originates from untrusted prompt input. The markdown block component that renders form-like elements did not restrict which HTML tags could be produced from user-controlled content, allowing arbitrary interactive HTML to be embedded. The fix in commit 55edd50 modifies form.tsx to gate incoming values and remove support for unsafe tag rendering.

Attack Vector

Exploitation is network-based and requires only low authenticated privileges to submit a prompt or chat message. The attacker crafts a prompt containing an HTML <form> or <input> payload with attributes that trigger script execution or credential capture, such as a fake login form pointing at an attacker-controlled endpoint. The payload persists in the chat log store. When an administrator visits the log viewer, the browser renders the injected markup within the admin's origin, permitting theft of session cookies, API tokens, or credentials submitted into the spoofed form.

text

// Patch excerpt from web/app/components/base/markdown-blocks/form.tsx
+import React, { useEffect, useState } from 'react'
 import Button from '@/app/components/base/button'
 import Input from '@/app/components/base/input'
 import Textarea from '@/app/components/base/textarea'
// Source: https://github.com/langgenius/dify/commit/55edd5047e6fcbc9bb56a4ea055fcce090f3eb5d
// The patch reworks how form values are handled and constrains
// which markdown-derived HTML elements are instantiated.

Detection Methods for CVE-2024-11824

Indicators of Compromise

Chat log entries containing raw HTML tags such as <form, <input, <iframe, or <script inside prompt bodies.
Outbound HTTP requests from administrator browsers to unfamiliar domains immediately after opening the Dify log viewer.
Unexpected credential prompts or login overlays appearing inside the Dify admin console.
New or modified administrator sessions originating from IP addresses that previously only submitted low-privilege prompts.

Detection Strategies

Inspect the Dify database messages and conversations tables for prompt content matching HTML tag patterns using regular expressions.
Enable Content Security Policy (CSP) reporting on the Dify web front end and alert on form-action and script-src violations.
Correlate low-privileged user prompt submissions with subsequent administrator session anomalies in web access logs.

Monitoring Recommendations

Log and review all admin actions in the chat log viewer, including which conversation IDs were opened.
Track the running Dify version and alert when instances below 0.12.1 remain deployed.
Monitor egress traffic from workstations used to administer Dify for connections to non-corporate destinations during log review sessions.

How to Mitigate CVE-2024-11824

Immediate Actions Required

Upgrade all Dify deployments to version 0.12.1 or later, which contains the fix from commit 55edd50.
Rotate administrator credentials, API keys, and session tokens for any Dify instance that ran a vulnerable version and processed untrusted prompts.
Restrict who can submit prompts to production Dify instances while patching is in progress.
Audit historical chat logs for HTML injection artifacts before allowing administrators to reopen them in a browser.

Patch Information

The vulnerability is resolved in Dify 0.12.1. The upstream fix is documented in the GitHub commit 55edd50, which updates web/app/components/base/markdown-blocks/form.tsx to constrain incoming values and prevent unsafe HTML from rendering in the chat log view. Additional context is available in the Huntr bounty listing.

Workarounds

Place the Dify admin console behind a reverse proxy that strips or escapes HTML tags in log responses until the upgrade is applied.
Deploy a strict Content Security Policy that disallows inline scripts and restricts form-action to the Dify origin.
Review chat logs through a text-only exporter or curl rather than the web UI on vulnerable versions.
Limit prompt submission to trusted, authenticated internal users until the patch is deployed.

bash

# Upgrade a self-hosted Dify Docker deployment to the patched release
cd dify/docker
git fetch --tags
git checkout 0.12.1
docker compose pull
docker compose up -d
docker compose exec api python -c "import importlib.metadata as m; print(m.version('dify'))"