CVE-2024-12039
📋 TL;DR
This vulnerability allows unauthenticated attackers to reset passwords for any user, including administrators, by brute-forcing a six-digit reset code with no rate limiting. All Dify installations running version v0.10.1 are affected, potentially leading to complete application compromise.
💻 Affected Systems
- langgenius/dify
📦 What is this software?
Dify by Langgenius
⚠️ Risk & Real-World Impact
Worst Case
Complete takeover of the application with administrative privileges, allowing data theft, service disruption, and further system compromise.
Likely Case
Attacker gains administrative access, modifies configurations, accesses sensitive data, and potentially deploys backdoors.
If Mitigated
Failed login attempts are logged and rate-limited, preventing successful brute-force attacks.
🎯 Exploit Status
Exploitation requires only automated guessing of six-digit codes with no authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v0.10.2 or later
Vendor Advisory: https://huntr.com/bounties/61af30d5-6055-4c6c-8a55-3fa43dada512
Restart Required: No
Instructions:
1. Update Dify to version v0.10.2 or later. 2. Verify the update was successful. 3. Consider forcing password resets for all users.
🔧 Temporary Workarounds
Implement rate limiting
allAdd rate limiting to password reset endpoints to prevent brute-force attacks.
Disable password reset functionality
allTemporarily disable password reset if not critically needed.
🧯 If You Can't Patch
- Implement network-level rate limiting (e.g., via WAF or reverse proxy)
- Monitor logs for excessive password reset attempts and alert on suspicious activity
🔍 How to Verify
Check if Vulnerable:
Check Dify version; if running v0.10.1, it is vulnerable.Check Version:
Check Dify configuration or deployment manifest for version.Verify Fix Applied:
Confirm version is v0.10.2 or later and test password reset with rate limiting.📡 Detection & Monitoring
Log Indicators:
- Multiple failed password reset attempts from single IP
- Successful password reset for admin/owner accounts
Network Indicators:
- High volume of POST requests to /api/password-reset endpoint
SIEM Query:
source="dify_logs" AND (event="password_reset_failed" count>10 within 1h OR event="password_reset_success" for admin)