Exploit for Generation of Predictable Numbers or Identifiers in Infiniflow Ragflow

## https://sploitus.com/exploit?id=E34B05F3-CFD0-551F-A473-8FE997762485
# ragflow-audit

**RAGFlow Three-Dungeon Audit Tool** (CVE-2026-28797 / CVE-2026-24770 / CVE-2025-69286)

- **ssti**: Detects and exploits SSTI vulnerabilities via StringTransform/Message components → RCE
- **zipslip**: Offline detection of path traversal vulnerabilities in ZIP files
- **apikey**: Derives API keys from shared link beta versions (UUID1 timestamp enumeration)

This tool is a pure Python standard library; no third-party dependencies required. Can be run directly on Python 3.8+.

## Usage

```
python3 ragflow-audit.py [-h] {ssti,zipslip,apikey} ...
```

### ssti

```
python3 ragflow-audit.py ssti --url http://TARGET:9380 --auth "AUTH_HEADER" [--component StringTransform|Message] [--newline]
```

- `--url`: RAGFlow web address
- `--auth`: Full value of the Authorization header for login
- `--component`: Target component (default: StringTransform)
- `--newline`: Uses line breaks to bypass payload detection (bypasses `_is_jinjia2` regex check)

**Process**: Constructs a malicious canvas DSL → creates a canvas via `POST /v1/canvas/set` → triggers execution via `POST /v1/canvas/completion` → checks if `uid=` in the output indicates successful RCE.

### zipslip

```
python3 ragflow-audit.py zipslip --zip evil.zip [--extract-dir /tmp/out]
```

Offlines checks ZIP entries, identifying three types of vulnerabilities: path traversal (`..`), absolute paths, and symbolic links.

### apikey

```
python3 ragflow-audit.py apikey --beta "shared-link-token" --node "attackeruser_id_last12digits"
```

Derives UUID1 bodies from shared link beta tokens, enumerates time lows, and outputs candidate tokens. In real exploitation, each candidate token requires authenticated calls to authorized APIs (200 success/401 continues).

## Authentication Notes

RAGFlow’s login credentials are in the **Authorization header**, not the `access_token` in the body. The `access_token` in the body is just a UUID; calling the API will result in a 401 error.
```
curl -i -X POST http://TARGET:9380/v1/user/login \
  -H 'Content-Type: application/json' \
  -d '{"email":"x@x.com","password":""}'
```

Take the value of the `authorization:` header as the `--auth` parameter. Note: The password for registration/login must be RSA-encrypted (public key: `/ragflow/conf/public.pem`, PKCS1_v1_5; encryption target is the plaintext after Base64 encoding). Passing plain-text passwords will result in errors.

## Vulnerability Background

| CVE | Type | Affected Versions | Fixed Version |
|-----|------|--------------|-------------|
| CVE-2026-28797 | SSTI (StringTransform/Message components) | < 0.25.0 (NVD: 0.24.0 and earlier) | 0.25.0 (Sandbox fix, merged on 2026-03-02) |
| CVE-2026-24770 | MinerU parser Zip Slip | < 0.23.1 | 0.23.1 |
| CVE-2025-69286 | API keys can be derived (UUID1 + tenant_id key) | < 0.22.0 | 0.22.0 |

## Disclaimer

This tool is intended only for authorized security testing and vulnerability research purposes. Any consequences resulting from using this tool on others’ systems without authorization are the sole responsibility of the user.