PT-2024-27332 · Flowise · Flowise

Kevin Stubbings · Published 2024-07-01 · Updated 2024-08-21 · CVE-2024-37145

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Flowise version 1.4.3

Description A reflected cross-site scripting issue occurs in the "/api/v1/chatflows-streaming/id" endpoint of Flowise. This allows an attacker to craft a specially crafted URL that injects Javascript into user sessions, potentially stealing information, creating false popups, or redirecting users to other websites. If the chatflow ID is not found, its value is reflected in the 404 page, enabling an attacker to attach arbitrary scripts and steal sensitive information. This issue may be chained with path injection to read arbitrary files from the Flowise server.

Recommendations For version 1.4.3, as a temporary workaround, consider disabling access to the "/api/v1/chatflows-streaming/id" endpoint until a patch is available. Restrict access to unauthenticated configurations to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-37145

GHSA-858C-QXVX-RG9V

Affected Products

Flowise

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/37xxx/CVE-2024-37145.json · Exploit
• 🔥 https://securitylab.github.com/advisories/GHSL-2023-232_GHSL-2023-234_Flowise · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-37145 · Security Note
• https://osv.dev/vulnerability/GHSA-858c-qxvx-rg9v · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-37145 · Vendor Advisory
• https://github.com/FlowiseAI/Flowise · Note
• https://github.com/FlowiseAI/Flowise/blob/flowise-ui%401.4.0/packages/server/src/index.ts#L375-L375 · Note
• https://t.me/cvenotify/91544 · Telegram Post
• https://t.me/cvenotify/84939 · Telegram Post