Dify CVE-2025-63387

No special conditions for reaching the endpoint - an unauthenticated remote GET to /console/api/system-features against a default Dify 1.9.1 console returns data. However, the security-relevant content is strongly LIMITED: per the source fix (PR #31392), the only fields that were improperly exposed to anonymous users are enterprise license status/expiry and workspace limit/usage figures, and these are only populated when ENTERPRISE_ENABLED is true - in a standard non-enterprise deployment the endpoint returns ordinary UI configuration flags (branding, SSO, marketplace) that are intended to be public. The maintainer asserts no PII, credentials, or secrets are returned, so realistic impact is reconnaissance-level metadata disclosure, not exposure of true secrets.

Signals conflict sharply here, and the conflict is the story. The NVD CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N = 7.5 HIGH) rates this as a remote, unauthenticated, low-complexity confidentiality breach with HIGH impact. However, the C:H rating is the weakest link: the Dify maintainer explicitly disputes it, stating the /console/api/system-features endpoint is unauthenticated BY DESIGN as a dashboard bootstrap mechanism and that the returned data is non-sensitive UI/client-rendering configuration containing no PII, credentials, or secrets. The source-code evidence (PR #31392) partially corroborates BOTH sides: the fix did not remove anonymous access to the endpoint, but it DID gate a subset of fields - enterprise license status, expiry date, and workspace limits/usage - behind an authentication check, implicitly conceding that this specific metadata should not have been anonymously readable. This narrows the true confidentiality impact to low-sensitivity enterprise license/config metadata, not 'sensitive system configuration.' No CISA KEV entry and no EPSS score are provided, so there is no evidence of active or probable widespread exploitation. Public gist references (Cristliu) suggest proof-of-concept material exists. Net assessment: this is a real but LOW-severity information-exposure/access-control issue that is over-scored at 7.5; the realistic confidentiality impact is C:L, making this a 'high-CVSS-but-modest-real-risk' finding. The HIGH score should be treated as contested pending confirmation of exactly what the endpoint returns in enterprise deployments.

An attacker who can reach the Dify console over the network sends a plain HTTP GET to /console/api/system-features with no credentials or session token and receives the system-features JSON, including (in pre-fix enterprise deployments) license status, expiry, and workspace quota metadata. Publicly referenced gists indicate proof-of-concept request examples exist. Given AV:N/AC:L/PR:N/UI:N, the request is trivial and requires no interaction, but the practical payoff is limited to low-sensitivity configuration reconnaissance.