CVE-2024-53450
📋 TL;DR
RAGFlow 0.13.0 has an improper access control vulnerability in document-hooks.ts that allows unauthenticated attackers to access user documents. This affects all deployments running the vulnerable version. The vulnerability stems from insufficient authorization checks in the document handling hooks.
💻 Affected Systems
- RAGFlow
📦 What is this software?
Ragflow by Infiniflow
⚠️ Risk & Real-World Impact
Worst Case
Attackers could access, modify, or delete all user documents in the system, potentially exposing sensitive information or disrupting operations.
Likely Case
Unauthorized users accessing documents they shouldn't have permission to view, leading to data exposure.
If Mitigated
With proper access controls, only authorized users can access documents according to their permissions.
🎯 Exploit Status
The vulnerability is in the web interface and requires no authentication. Public proof-of-concept exists showing exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: Yes
Instructions:
1. Monitor RAGFlow GitHub repository for security updates. 2. Upgrade to a patched version when available. 3. Restart the RAGFlow service after patching.
🔧 Temporary Workarounds
Network Access Restriction
linuxRestrict network access to RAGFlow to trusted IP addresses only
# Use firewall rules to restrict access
iptables -A INPUT -p tcp --dport [RAGFlow_PORT] -s [TRUSTED_IP] -j ACCEPT
iptables -A INPUT -p tcp --dport [RAGFlow_PORT] -j DROP
Authentication Proxy
allPlace RAGFlow behind an authentication proxy or reverse proxy with authentication
# Configure nginx with basic auth
location /ragflow/ {
proxy_pass http://localhost:[RAGFlow_PORT];
auth_basic "Restricted";
auth_basic_user_file /etc/nginx/.htpasswd;
}
🧯 If You Can't Patch
- Implement network segmentation to isolate RAGFlow from untrusted networks
- Deploy a web application firewall (WAF) with authentication bypass protection rules
🔍 How to Verify
Check if Vulnerable:
Check if running RAGFlow 0.13.0 by examining version files or configuration. Test unauthenticated access to document endpoints.Check Version:
Check package.json or version files in the RAGFlow installation directoryVerify Fix Applied:
After applying workarounds, test that unauthenticated requests to document endpoints return proper authentication errors.📡 Detection & Monitoring
Log Indicators:
- Unauthenticated requests to document endpoints
- Access to /api/documents or similar endpoints without authentication headers
- Unusual document access patterns from single IP addresses
Network Indicators:
- HTTP requests to document endpoints without authentication tokens
- Unusual volume of document requests from external IPs
SIEM Query:
source="ragflow" AND (uri_path="/api/documents" OR uri_path="/documents") AND NOT (http_auth_token EXISTS OR cookie EXISTS)