Vulnerability Overview Title: Blind Server-Side Request Forgery (SSRF) Bypass via OpenAI Plugin Manifest Parsing Description: A blind Server-Side Request Forgery (SSRF) vulnerability exists in the component of the Dify application. When parsing user-provided API schemas, if the input mimics an OpenAI plugin manifest (JSON), the parser automatically extracts the field and performs a direct HTTP GET request to retrieve the referenced OpenAPI specification. This request is issued using without applying the application’s internal SSRF protection ( ), allowing authenticated users to force the server to connect to arbitrary internal network resources. Impact Scope Affected Products: - Ecosystem: PyPI / Docker - Package Name: langgenius/dify - Affected Versions: <= v1.13.3 Severity: Medium (Blind SSRF / Bypass) Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N Remediation Remediation Recommendation: Apply the application’s internal SSRF protection ( ) to prevent unauthorized internal network access. POC Code Exploitation Code Observations If port is closed/rejected: The request quickly returns a 500 or 400 error involving . If port is open (but does not return YAML): The request connects and eventually returns or . Time-based detection: Response time differs significantly (up to 5 seconds) when targeting a non-responsive IP versus a responsive one. Impact SSRF Protection Bypass: This vector bypasses UI-level URL validation or other import restrictions because the URL is embedded within the JSON payload. Internal Network Scanning: Attackers can probe internal ports and services (based on timing or errors). Service Interaction: May trigger GET operations on internal REST APIs that do not require a valid payload (since the parser disconnects after fetching). Weakness CWE: CWE-918: Server-Side Request Forgery (SSRF) Occurrence Permanent Link: https://github.com/langgenius/dify/blob/main/api/core/tools/utils/parser.py#L364 Description: Vulnerable