CVE-2024-12433
Critical
Description
A vulnerability in infiniflow/ragflow versions v0.12.0 allows for remote code execution. The RPC server in RagFlow uses a hard-coded AuthKey 'authkey=b'infiniflow-token4kevinhu'' which can be easily fetched by attackers to join the group communication without restrictions. Additionally, the server processes incoming data using pickle deserialization via `pickle.loads()` on `connection.recv()`, making it vulnerable to remote code execution. This issue is fixed in version 0.14.0.
SeverityCritical
CVSS9.8
Exploit probability—
ProductInfiniflow Ragflow
PublishedMar 20, 2025
First seenMar 20, 2025
Weakness typeCWE-502Deserialization of untrusted data
How to fix
Update
- infiniflow ragflow0.14.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| infiniflow ragflow | 0.12.0 ≤ v < 0.14.0 | 0.14.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.