PT-2024-27333 · Flowise · Flowise

Kevin Stubbings + 1 · Published 2024-07-01 · Updated 2024-08-21 · CVE-2024-37146

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Flowise version 1.4.3

Description A reflected cross-site scripting issue occurs in the "/api/v1/credentials/id" endpoint. If the default configuration is used, an attacker may craft a specially crafted URL to inject Javascript into user sessions, allowing information theft, false popups, or redirects to other websites. The chatflow ID value is reflected in the 404 page, enabling attackers to attach arbitrary scripts and steal sensitive information. This issue may be chained with path injection to read arbitrary files from the Flowise server.

Recommendations For version 1.4.3, as a temporary workaround, consider disabling access to the "/api/v1/credentials/id" endpoint until a patch is available. Restrict the use of the chatflow ID parameter to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-37146

GHSA-WXM4-9F8P-GGGV

Affected Products

Flowise

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/37xxx/CVE-2024-37146.json · Exploit
• 🔥 https://securitylab.github.com/advisories/GHSL-2023-232_GHSL-2023-234_Flowise · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-37146 · Security Note
• https://osv.dev/vulnerability/GHSA-wxm4-9f8p-gggv · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-37146 · Vendor Advisory
• https://github.com/FlowiseAI/Flowise · Note
• https://github.com/FlowiseAI/Flowise/blob/flowise-ui%401.4.0/packages/server/src/index.ts#L545-L545 · Note
• https://t.me/cvenotify/91545 · Telegram Post
• https://t.me/cvenotify/84940 · Telegram Post