Dify CVE-2025-63388

Exploitation requires (1) a Dify console user with an active authenticated session who (2) visits or is redirected to an attacker-controlled web page while that session is live; the attacker's JavaScript then issues a credentialed cross-origin request to the specific /console/api/system-features endpoint, which reflects the arbitrary Origin and returns Access-Control-Allow-Credentials: true. Limiting factors: the attack fails if the victim is not logged in, reaches only this single endpoint's data rather than arbitrary API access, and - per the supplier's dispute - may expose nothing beyond unauthenticated content, which would make the condition exploitable but of negligible value. No vendor-side configuration toggle is cited as a precondition; the permissive CORS behavior is described as present in default Dify v1.9.1.

The input assigns CVSS 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), which on paper indicates a critical, network-exploitable, unauthenticated flaw. However, multiple signals conflict with that severity. First, this is a CORS misconfiguration (CWE-346): such attacks are not truly 'no user interaction' - they require an already-authenticated Dify console user to visit an attacker-controlled web page, so the real-world precondition is stronger than UI:N suggests. Second, the I:H (integrity high) rating is questionable because reading a reflected cross-origin response is an information-disclosure primitive (the input's own tag is 'Information Disclosure'), not a write/modify primitive. Third, and most importantly, the SUPPLIER DISPUTES the vulnerability, arguing that credentialed requests to /console/api/system-features expose nothing beyond what an unauthenticated request already returns - if true, the confidentiality impact collapses toward negligible. No EPSS score, KEV listing, or SSVC decision data was provided, so exploitation probability and automatability cannot be quantified from the input. Two referenced gists and a GitHub discussion thread exist but are not confirmed as working exploit code in the input metadata. Net assessment: this is most likely a high-CVSS-but-contested, low-real-risk issue whose actual severity hinges entirely on whether the /console/api/system-features response contains sensitive data - a fact the vendor explicitly disputes and which should be verified before prioritization.

An attacker hosts a malicious web page and lures a currently-logged-in Dify console operator to visit it. JavaScript on that page issues a credentialed cross-origin fetch to the victim instance's /console/api/system-features endpoint; because the endpoint reflects the arbitrary Origin header and sets Access-Control-Allow-Credentials: true, the attacker's script can read the authenticated JSON response and exfiltrate whatever system-feature data it contains. No confirmed public exploit code is identified in the input, though two referenced gists may contain technical proof-of-concept details.