# Dify APP DSL Export Endpoint Access

- **Severity:** Medium
- **Signature ID:** `7f3c9a12-5d84-4b6e-9c0a-2e18d4f7b365`

## Summary

Older versions of Dify's console let any logged-in workspace member download an application's complete definition, not just administrators. That export can include the app's prompts, workflow logic, model settings, and — if requested — the API keys and credentials wired into it.

## How the attack works

An authenticated user in a Dify workspace calls the app DSL export endpoint (/console/api/apps/<app_id>/export or the equivalent path behind default nginx routing) for an application they can see but may not administer. Dify versions up to 0.6.8 do not check for admin-level authorization on this route, so the request succeeds regardless of the caller's role. If the request adds include_secret=true, the exported file also contains the provider API keys and other credential material embedded in the app. The result is a downloadable dump of the app's prompts, workflow graph, tool wiring, and optionally its secrets, obtained without needing elevated privileges.

## Why it matters

A low-privileged workspace member can extract another application's intellectual property (prompts, workflow design) and, in the worst case, its live API keys — enabling credential theft or unauthorized use of connected AI providers.

## What you can do

- Upgrade Dify past 0.6.13, where role-based access control was tightened on this endpoint.
- Until upgraded, restrict workspace membership and treat all workspace members as able to read any app's DSL, including secrets if include_secret is used.
- Review logs for export requests with include_secret=true and rotate any credentials that may have been exposed.
- Baseline expected automation (CI, backups, migrations) that calls this endpoint on a schedule so ad-hoc or unexpected calls stand out.

## Known benign look-alikes

- Workspace administrator legitimately exporting an application DSL through the Dify console while an agent-driven browser session is being proxied.
- Scheduled backup or GitOps automation that snapshots app DSL definitions on a cadence — expect a repeating, same-source pattern and baseline it.
- CI or migration tooling copying applications between Dify workspaces or between staging and production instances.
- Internal red-team or patch-verification testing against a Dify instance already upgraded past 0.6.13, where the endpoint now correctly rejects non-admins.

## References

- https://github.com/langgenius/dify
- https://owasp.org/Top10/A01_2021-Broken_Access_Control/
- https://attack.mitre.org/techniques/T1213/

---
Source: https://www.netzilo.com/threats/dify-app-dsl-export-unauthorized