PT-2024-26989 · Flowise · Flowise

Kevin Stubbings · Published 2024-07-01 · Updated 2024-08-05 · CVE-2024-36421

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Flowise version 1.4.3

Description The issue is related to a CORS misconfiguration in Flowise, where the Access-Control-Allow-Origin header is set to allow all origins, enabling arbitrary origins to connect to the website. This could allow unauthorized access to user information. Additionally, this misconfiguration may be exploited in conjunction with path injection to read arbitrary files from the Flowise server.

Recommendations For version 1.4.3, as a temporary workaround, consider restricting access to the Flowise interface to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Origin Validation Error

Weakness Enumeration

CWE-346

Related Identifiers

CVE-2024-36421

GHSA-66F2-XXGM-F6XP

Affected Products

Flowise

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/36xxx/CVE-2024-36421.json · Exploit
• 🔥 https://securitylab.github.com/advisories/GHSL-2023-232_GHSL-2023-234_Flowise · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-36421 · Security Note
• https://osv.dev/vulnerability/CVE-2024-36421 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-66f2-xxgm-f6xp · Vendor Advisory
• https://github.com/FlowiseAI/Flowise · Note
• https://github.com/FlowiseAI/Flowise/blob/e93ce07851cdc0fcde12374f301b8070f2043687/packages/server/src/index.ts#L122 · Note
• https://twitter.com/cracbot/status/1809105073920004211 · Twitter Post