| Package | Affected versions | Patched versions |
|---|---|---|
| dify | = 0.10.1 |
langgenius/dify version 0.10.1 contains a Server-Side Request Forgery (SSRF) vulnerability in the test functionality for the Create Custom Tool option via the REST API `POST /console/api/workspaces/current/tool-provider/api/test/pre`. Attackers can set the `url` in the `servers` dictionary in OpenAI's schema with arbitrary URL targets, allowing them to abuse the victim server's credentials to access unauthorized web resources.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free