CVE-2025-56520
BaseFortify
Publication date: 2025-09-30
Last updated on: 2025-10-07
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| dify | dify | 1.6.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-918 | The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-56520 is a Server-Side Request Forgery (SSRF) vulnerability in Dify version 1.6.0, specifically in the controllers.console.remote_files.RemoteFileInfoApi class. The vulnerability occurs because the API accepts a URL parameter and makes outbound requests via ssrf_proxy.head without any authentication or authorization checks. This allows unauthorized users to make arbitrary outbound requests through the application, potentially accessing internal or restricted network resources. [1]
How can this vulnerability impact me? :
This vulnerability can allow unauthorized users to make arbitrary outbound requests from the vulnerable application, potentially accessing internal or restricted network resources that should not be exposed. This can lead to unauthorized data access, information disclosure, or further exploitation of internal systems. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection of this SSRF vulnerability involves monitoring for unauthorized outbound requests initiated by the vulnerable API endpoint. You can look for unusual outbound HTTP requests originating from the Dify application, especially those triggered by calls to the `controllers.console.remote_files.RemoteFileInfoApi` class. Network monitoring tools or logs can be used to identify such requests. Specific commands depend on your environment, but for example, using tcpdump or Wireshark to capture outbound traffic from the server hosting Dify, or checking application logs for requests to the RemoteFileInfoApi endpoint. However, no explicit detection commands are provided in the available resources. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to implement proper authentication and authorization on the vulnerable API interface (`controllers.console.remote_files.RemoteFileInfoApi`) to prevent unauthorized users from exploiting the SSRF vulnerability. Restrict access so that only legitimate users can invoke the functionality that makes outbound requests. Additionally, review and restrict outbound requests made by the application to trusted destinations only, if possible. [1]