What happened
The unauthenticated /console/api/remote-files/upload endpoint accepted an attacker-controlled URL and caused the Dify server to fetch it (CWE-918 SSRF). A remote attacker can direct the LLM-platform server against internal services or cloud metadata endpoints (169.254.169.254), exposing sensitive data and allowing the server to be used as a network pivot. Fixed in Dify 1.13.0; CISA SSVC marks it exploitation=poc and automatable=yes.
Why it matters
Dify is a widely deployed open-source LLM app-development platform. An unauthenticated, automatable SSRF in the console remote-file handler gives attackers direct read access to cloud IAM/instance metadata and internal APIs from inside a tenant that often holds model API keys and RAG document stores — no account needed.
Attack vector
POST a URL pointing at 169.254.169.254/latest/meta-data or an internal service to /console/api/remote-files/upload; Dify server fetches it and reflects/stores the response.
Affected systems
Dify (langgenius/dify) < 1.13.0
Mitigation
Upgrade to Dify 1.13.0; block egress to link-local/internal ranges at the network layer if upgrade is delayed.