Deserialization in Infiniflow Infiniflow/ragflow
CVE-2024-12433
A vulnerability in infiniflow/ragflow versions v0.12.0 allows for remote code execution. The RPC server in RagFlow uses a hard-coded AuthKey 'authkey=b'infiniflow-token4kevinhu'' which can be easily fetched by attackers to join the group communication without restrictions. Additionally, the server processes incoming data using pickle deserialization via `pickle.loads()` on `connection.recv()`, making it vulnerable to remote code execution. This issue is fixed in version 0.14.0.
Vulnerability class: Insecure Deserialization
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.017 (77.1th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 77th percentile — 77.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.017 · newest: 0.017 · change: 0.000
Affected products
- Infiniflow Infiniflow/ragflow — versions unspecified
- Infiniflow Ragflow
Weakness classification (CWE)
References
- huntr.com/bounties/8a1465af-09e4-42af-9e54-0b70e7c87499 (Exploit, Third Party Advisory)
- github.com/infiniflow/ragflow/commit/49494d4e3c8f06a5e52cf1f7cce9fa03cadcfbf6 (Patch)
Frequently asked questions
- What is CVE-2024-12433?
- CVE-2024-12433 is a critical-severity vulnerability in Infiniflow Infiniflow/ragflow, classified under Deserialization of Untrusted Data. CVSS score: 9.8/10. Published 2025-03-20.
- How severe is CVE-2024-12433?
- Critical severity. CVSS v3 base score is 9.8 out of 10.