Threats tagged 'ghsa-4fc6-wx4f-48w6'

Dify versions prior to 1.15.0 contain a server-side request forgery (SSRF) vulnerability that allows any authenticated console user to bypass SSRF protections and send arbitrary HTTP requests to internal services and cloud metadata endpoints. This is due to insufficient proxy ACL configuration and lack of destination IP validation in the make_request() helper. Exploitation can lead to unauthorized access to internal components and sensitive data such as AWS IAM credentials.