CVE-2025-63386
BaseFortify
Publication date: 2025-12-18
Last updated on: 2026-02-11
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| langgenius | dify | 1.9.1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-346 | The product does not properly verify that the source of data or communication is valid. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Cross-Origin Resource Sharing (CORS) misconfiguration in Dify version 1.9.1 at the /console/api/setup endpoint. The endpoint insecurely reflects the Origin header from incoming requests into the Access-Control-Allow-Origin response header without validation and sets Access-Control-Allow-Credentials to true. This allows any external domain to make authenticated cross-origin requests to the endpoint, enabling an attacker to perform actions or retrieve sensitive setup information by tricking an authenticated user into visiting a malicious website. [1]
How can this vulnerability impact me? :
The vulnerability can lead to information disclosure by allowing attackers to access confidential installation and setup data remotely. An attacker can exploit this by hosting a malicious website that makes authenticated cross-origin requests on behalf of an authenticated user, potentially exposing sensitive configuration information. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
You can detect this vulnerability by sending a request to the /console/api/setup endpoint with a custom Origin header and inspecting the response headers. If the Access-Control-Allow-Origin header reflects the Origin you sent and Access-Control-Allow-Credentials is set to true, the system is vulnerable. For example, use curl to test: curl -i -H "Origin: http://malicious.example.com" https://your-dify-instance/console/api/setup and check if the response includes Access-Control-Allow-Origin: http://malicious.example.com and Access-Control-Allow-Credentials: true. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting the Access-Control-Allow-Origin header to only trusted domains instead of reflecting any Origin header, and disabling Access-Control-Allow-Credentials unless absolutely necessary. Applying any available patches or updates from the vendor that address this CORS misconfiguration is also recommended. [1]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows attackers to perform authenticated cross-origin requests and access sensitive installation and setup information, leading to potential information disclosure. This could result in unauthorized access to confidential data, which may violate data protection requirements under standards like GDPR and HIPAA that mandate safeguarding personal and sensitive information against unauthorized access. [1]