CVE-2024-12433

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2024-12433

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-12433.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-12433

Published

2025-03-20T10:15:28.760Z

Modified

2026-03-12T00:25:58.786692Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

A vulnerability in infiniflow/ragflow versions v0.12.0 allows for remote code execution. The RPC server in RagFlow uses a hard-coded AuthKey 'authkey=b'infiniflow-token4kevinhu'' which can be easily fetched by attackers to join the group communication without restrictions. Additionally, the server processes incoming data using pickle deserialization via pickle.loads() on connection.recv(), making it vulnerable to remote code execution. This issue is fixed in version 0.14.0.

References

Affected packages

Git / github.com/infiniflow/ragflow

Affected ranges

Type

GIT

Repo

https://github.com/infiniflow/ragflow

Events

Introduced

92a4a095c922690b31e9ef557b708d3920d092a9

Fixed

49494d4e3c8f06a5e52cf1f7cce9fa03cadcfbf6

Database specific

{
    "versions": [
        {
            "introduced": "0.12.0"
        },
        {
            "fixed": "0.14.0"
        }
    ]
}

Affected versions

v0.*

v0.12.0

v0.13.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-12433.json"