Dify APP DSL Export Endpoint Access
Older versions of Dify's console let any logged-in workspace member download an application's complete definition, not just administrators. That export can include the app's prompts, workflow logic, model settings, and — if requested — the API keys and credentials wired into it.
How the attack works
An authenticated user in a Dify workspace calls the app DSL export endpoint (/console/api/apps/<app_id>/export or the equivalent path behind default nginx routing) for an application they can see but may not administer. Dify versions up to 0.6.8 do not check for admin-level authorization on this route, so the request succeeds regardless of the caller's role. If the request adds include_secret=true, the exported file also contains the provider API keys and other credential material embedded in the app. The result is a downloadable dump of the app's prompts, workflow graph, tool wiring, and optionally its secrets, obtained without needing elevated privileges.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 7f3c9a12-5d84-4b6e-9c0a-2e18d4f7b365
- Severity
- Medium
Why it matters
A low-privileged workspace member can extract another application's intellectual property (prompts, workflow design) and, in the worst case, its live API keys — enabling credential theft or unauthorized use of connected AI providers.
What you can do
- →Upgrade Dify past 0.6.13, where role-based access control was tightened on this endpoint.
- →Until upgraded, restrict workspace membership and treat all workspace members as able to read any app's DSL, including secrets if include_secret is used.
- →Review logs for export requests with include_secret=true and rotate any credentials that may have been exposed.
- →Baseline expected automation (CI, backups, migrations) that calls this endpoint on a schedule so ad-hoc or unexpected calls stand out.
Known benign look-alikes
- Workspace administrator legitimately exporting an application DSL through the Dify console while an agent-driven browser session is being proxied.
- Scheduled backup or GitOps automation that snapshots app DSL definitions on a cadence — expect a repeating, same-source pattern and baseline it.
- CI or migration tooling copying applications between Dify workspaces or between staging and production instances.
- Internal red-team or patch-verification testing against a Dify instance already upgraded past 0.6.13, where the endpoint now correctly rejects non-admins.