PT-2024-26990 · Flowise · Flowise

Kevin Stubbings · Published 2024-07-01 · Updated 2024-08-05 · CVE-2024-36422

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Flowise version 1.4.3

Description A reflected cross-site scripting issue occurs in the "api/v1/chatflows/id" endpoint of Flowise. This allows an attacker to craft a specially crafted URL that injects Javascript into user sessions, potentially stealing information, creating false popups, or redirecting users to other websites. If the chatflow ID is not found, its value is reflected in the 404 page, enabling an attacker to attach arbitrary scripts and steal sensitive information. This issue may be chained with path injection to read arbitrary files from the Flowise server.

Recommendations For version 1.4.3, as a temporary workaround, consider disabling the api/v1/chatflows/id endpoint until a patch is available. Restrict access to this endpoint to minimize the risk of exploitation. Avoid using the id parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-36422

GHSA-2JCH-QC96-9F5G

Affected Products

Flowise

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/36xxx/CVE-2024-36422.json · Exploit
• 🔥 https://securitylab.github.com/advisories/GHSL-2023-232_GHSL-2023-234_Flowise · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-36422 · Security Note
• https://osv.dev/vulnerability/CVE-2024-36422 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2jch-qc96-9f5g · Vendor Advisory
• https://github.com/FlowiseAI/Flowise · Note
• https://github.com/FlowiseAI/Flowise/blob/flowise-ui%401.4.0/packages/server/src/index.ts#L312-L312 · Note
• https://t.me/cvenotify/85110 · Telegram Post