Infiniflow RagFlow Remote Code Execution Vulnerability

A remote code execution vulnerability exists in Infiniflow RagFlow version 0.12.0. The issue arises because the RPC server uses a hard-coded AuthKey that can be easily retrieved by attackers, allowing them to join group communications without restrictions. Furthermore, the server is vulnerable to remote code execution due to pickle deserialization of incoming data, which is processed using 'pickle.loads()' on 'connection.recv()'.

Impact

Exploitation of this vulnerability allows for remote code execution on the server where RagFlow is running.

Remediation

Users can upgrade to Infiniflow RagFlow version 0.14.0 or later to address this vulnerability.