CVE-2024-12779 Overview
CVE-2024-12779 is a Server-Side Request Forgery (SSRF) vulnerability in Infiniflow RAGFlow version 0.12.0. The flaw resides in the POST /v1/llm/add_llm and POST /v1/conversation/tts REST API endpoints. Attackers supply an arbitrary URL as the api_base parameter when registering an OPENAITTS model. They then invoke the tts endpoint to force the server to fetch content from the attacker-controlled URL. This grants unauthorized read access to internal web resources, cloud metadata services, and other network-adjacent assets normally shielded from external callers. The issue is tracked under CWE-918.
Critical Impact
Unauthenticated network-based SSRF allows attackers to read internal resources reachable by the RAGFlow server, including cloud metadata endpoints and internal services.
Affected Products
- Infiniflow RAGFlow 0.12.0
- Deployments exposing the /v1/llm/add_llm endpoint
- Deployments exposing the /v1/conversation/tts endpoint
Discovery Timeline
- 2025-03-20 - CVE-2024-12779 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-12779
Vulnerability Analysis
RAGFlow exposes a workflow for registering third-party large language model (LLM) providers through the POST /v1/llm/add_llm endpoint. When an operator adds an OPENAITTS model, the request accepts an api_base field that specifies the base URL used for outbound requests to the text-to-speech provider. RAGFlow does not validate or restrict this URL. Any host, including internal IP ranges and cloud metadata services such as 169.254.169.254, is accepted.
A subsequent call to POST /v1/conversation/tts triggers the server to issue an HTTP request against the stored api_base. The response body is returned to the caller, converting the intended TTS integration into an arbitrary URL fetch primitive. This is a classic SSRF pattern where user-supplied input flows into a server-side HTTP client without allowlisting.
Root Cause
The root cause is missing input validation on the api_base parameter in the LLM provider registration flow. RAGFlow trusts operator-supplied provider URLs and does not enforce a scheme allowlist, domain allowlist, or block private and link-local address ranges before dispatching outbound requests.
Attack Vector
Exploitation requires network access to the RAGFlow API. An attacker submits a crafted add_llm request with model_type set to OPENAITTS and api_base pointing to an internal target. The attacker then invokes the tts conversation endpoint, and the RAGFlow server proxies the response back. This enables reconnaissance of internal services, retrieval of cloud instance metadata, and interaction with unauthenticated internal HTTP APIs. See the Huntr Bounty Submission for the original technical writeup.
Detection Methods for CVE-2024-12779
Indicators of Compromise
- Requests to /v1/llm/add_llm containing OPENAITTS model type with non-standard api_base values pointing to private IP ranges (RFC1918) or 169.254.169.254.
- Outbound HTTP requests from the RAGFlow application server to internal hosts that do not correspond to legitimate TTS providers.
- Unusual /v1/conversation/tts invocations shortly after new LLM provider registrations.
Detection Strategies
- Inspect RAGFlow application logs for add_llm calls where api_base resolves to internal, loopback, or link-local addresses.
- Correlate LLM provider registration events with subsequent tts endpoint invocations from the same session or source IP.
- Deploy egress network monitoring on the RAGFlow host to flag connections destined for cloud metadata endpoints or internal management interfaces.
Monitoring Recommendations
- Enable verbose logging for all /v1/llm/* and /v1/conversation/* endpoints and forward events to a centralized SIEM.
- Alert on any successful HTTP responses returned to clients from the tts endpoint that contain content-types inconsistent with audio payloads.
- Track new LLM provider entries in the RAGFlow database and require change-review for each addition.
How to Mitigate CVE-2024-12779
Immediate Actions Required
- Restrict network exposure of the RAGFlow API to trusted operators and place it behind an authenticated reverse proxy.
- Audit all registered LLM providers and remove any OPENAITTS entries with unexpected api_base values.
- Enforce egress filtering on the RAGFlow host to block outbound traffic to RFC1918 ranges, 127.0.0.0/8, and 169.254.169.254.
Patch Information
No vendor advisory URL is listed in the NVD record for CVE-2024-12779. Operators should track the Infiniflow RAGFlow repository for releases newer than 0.12.0 and apply the latest available version. Refer to the Huntr Bounty Submission for remediation status.
Workarounds
- Disable the TTS conversation feature if it is not required in your deployment.
- Place RAGFlow behind an outbound HTTP proxy that enforces a strict allowlist of permitted TTS provider domains.
- Require administrative approval for all add_llm registrations and validate the api_base value against an allowlist before persisting it.
# Example iptables egress rules to block SSRF targets on the RAGFlow host
iptables -A OUTPUT -d 169.254.169.254 -j DROP
iptables -A OUTPUT -d 10.0.0.0/8 -j DROP
iptables -A OUTPUT -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -j DROP
iptables -A OUTPUT -d 127.0.0.0/8 ! -o lo -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
