CVE-2024-12776
📋 TL;DR
This vulnerability allows attackers to reset any user's password without verifying the reset code, enabling account takeover including administrator accounts. All users of affected Dify versions are at risk, potentially leading to complete application compromise.
💻 Affected Systems
- langgenius/dify
📦 What is this software?
Dify by Langgenius
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the application with administrative access, data theft, and potential lateral movement to connected systems.
Likely Case
Unauthorized access to user accounts, privilege escalation to administrator, and potential data exfiltration.
If Mitigated
Limited impact if strong network controls prevent external access, but internal threats remain.
🎯 Exploit Status
Exploitation requires knowledge of user email addresses and ability to send HTTP requests to the reset endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v0.10.2 or later
Vendor Advisory: https://huntr.com/bounties/00a8b403-7da5-431e-afa3-40339cf734bf
Restart Required: No
Instructions:
1. Update Dify to version 0.10.2 or later. 2. Run 'git pull' if using git. 3. Restart the Dify service if using containerized deployment.
🔧 Temporary Workarounds
Disable Password Reset Endpoint
allTemporarily disable the /forgot-password/resets endpoint via web server configuration or application firewall.
# For nginx: location /forgot-password/resets { deny all; }
# For Apache: <Location /forgot-password/resets> Require all denied </Location>
🧯 If You Can't Patch
- Implement network-level restrictions to block access to /forgot-password/resets endpoint from untrusted networks.
- Enable multi-factor authentication for all administrator accounts to reduce impact of password resets.
🔍 How to Verify
Check if Vulnerable:
Check if Dify version is 0.10.1 or earlier by examining the application version in the admin panel or package.json file.Check Version:
grep version package.json | head -1Verify Fix Applied:
Verify the application version is 0.10.2 or later and test password reset functionality with invalid codes to ensure they are rejected.📡 Detection & Monitoring
Log Indicators:
- Multiple failed password reset attempts followed by successful reset without code validation
- Password reset requests with suspicious or missing reset codes
Network Indicators:
- HTTP POST requests to /forgot-password/resets endpoint without proper parameters
- Unusual spikes in password reset traffic
SIEM Query:
source="dify_logs" AND (url_path="/forgot-password/resets" AND status=200) | stats count by src_ip, user