Summary

We have identified a vulnerability that can result in stored XSS in chat conversations. This can result in an attacker creating a malicious chat, which, when shared, will compromise a victim's session.

Details

Dify is vulnerable to a stored XSS issue when rendering Mermaid diagrams within chats. This occurs because Dify’s default Mermaid configuration uses securityLevel: loose, which allows potentially unsafe content to execute.

const initMermaid = () => {
  if (typeof window !== 'undefined' && !isMermaidInitialized) {
    try {
      const config: MermaidConfig = {
        startOnLoad: false,
        fontFamily: 'sans-serif',
        securityLevel: 'loose',
        flowchart: {
          htmlLabels: true,
          useMaxWidth: true,
          curve: 'basis',
          nodeSpacing: 50,
          rankSpacing: 70,
        },

web/app/components/base/mermaid/index.tsx

In Mermaid Gantt diagrams, you can attach click events to tasks, directing them either to a JavaScript callback or to an external link. This feature is available only when securityLevel is set to ‘loose’ and it is disabled when securityLevel is set to ‘strict’.

click taskId call callback(arguments)
click taskId href URL

This configuration allows users to embed JavaScript-based payloads into chatbot conversations by using the javascript protocol.

PoC

Create a ChatBot in the Dify app.
Include the following payload in the chat input field:

flowchart TD

A["Click"]

click A href "javascript:alert(location.href)"

After sending the message, click the generated element and observe that the pop up element is executed.

Impact

This can result in an attacker creating a malicious chat, which, when shared, will compromise a victim's session.