SSRF Vulnerability in RAGFlow Agent Workflow

RAGFlow before version 0.26.3 is susceptible to a server-side request forgery (SSRF) vulnerability located in the agent workflow "Invoke" component (agent/component/invoke.py). The vulnerability stems from improper validation of user-controlled URLs before they are passed to request methods (requests.get, requests.post, or requests.put). Unlike other components in the system such as the crawler or file-upload paths, the Invoke component fails to utilize the shared assert_url_is_safe validator or pin the resolved address. An attacker capable of creating or triggering an agent workflow can coerce the server to perform requests against loopback interfaces, link-local addresses, and RFC 1918 internal networks. This includes the ability to exfiltrate data from cloud instance metadata services (e.g., AWS IMDS), as the response body from the forged request is returned directly to the user as the component output.

Impact

Successful exploitation allows for the exfiltration of sensitive internal network data and cloud instance credentials. In cloud-hosted environments, attackers may query metadata endpoints to retrieve IAM roles or other configuration secrets, potentially leading to full cluster or cloud account compromise. The impact is significant because the application returns the forged request's response body directly to the attacker, facilitating easy data extraction.

Recommendation

• Upgrade RAGFlow to version 0.26.3 or later immediately to patch the SSRF vulnerability in the agent/component/invoke.py file.
• Implement strict egress filtering on the host machine running RAGFlow to block requests to loopback (127.0.0.0/8) and private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) unless explicitly required for known internal services.
• Configure cloud instances (e.g., EC2, GCP Compute) to require IMDSv2 with a session token requirement to mitigate credential exfiltration via SSRF.
• Audit existing agent workflows for suspicious Invoke component configurations, specifically those pointing to internal endpoints or utilizing runtime template variables for URL construction.