flowise@1.3.2 vulnerabilities

flowise is a Flowiseai Server

Affected versions of this package are vulnerable to Arbitrary Code Injection via the /api/v1/document-store/loader/process API. An attacker can execute arbitrary code by manipulating the fileName parameter to traverse directories and overwrite critical files such as package.json, leading to remote code execution when the server is started.

Note:

The writing functions addBase64FilesToStorage, addArrayFilesToStorage and addSingleFileToStorage in packages/components/src/storageUtils.ts are vulnerable.

Upgrade flowise to version 2.1.0 or higher.

flowise is a Flowiseai Server

Affected versions of this package are vulnerable to Arbitrary File Upload through the /api/v1/attachments endpoint. An attacker can upload malicious files to the server by sending specially crafted requests to this endpoint.

Note:

This is only exploitable if the server configuration allows file uploads without proper validation or sanitization.

Upgrade flowise to version 2.2.7-patch.1 or higher.

flowise is a Flowiseai Server

Affected versions of this package are vulnerable to External Control of System or Configuration Setting via the overrideConfig option. An attacker can execute arbitrary code, crash the server, perform server-side request forgery and exfiltrate server variables and data by injecting malicious configurations.

Upgrade flowise to version 2.1.4 or higher.

flowise is a Flowiseai Server

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) in the creation of a chatflow. An attacker can bypass input filters by providing a snippet without an event handler as input to a conversation, like <iframe src=javascript:console.log(document.domain)>. This input is passed on to the administration panel and executed.

Upgrade flowise to version 2.1.1 or higher.

flowise is a Flowiseai Server

Affected versions of this package are vulnerable to Uncontrolled Resource Consumption through the /api/v1/get-upload-file API endpoint. An attacker can cause the application to crash by sending specially crafted input.

There is no fixed version for flowise.

flowise is a Flowiseai Server

Affected versions of this package are vulnerable to Improper Authentication via the API endpoint authentication process. An attacker can gain unauthorized administrative access and manipulate restricted functionalities by bypassing the authentication mechanism.

Upgrade flowise to version 2.0.6 or higher.

flowise is a Flowiseai Server

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the /api/v1/public-chatflows/id endpoint, which returns a 404 page in the absence of a chatflow ID. An attacker can inject malicious scripts into the text/html page to read unintended files on the filesystem.

There is no fixed version for flowise.

flowise is a Flowiseai Server

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) through the /api/v1/chatflows-streaming/id, which returns a 404 page in the absence of a streaming ID. An attacker can inject malicious scripts into the text/html page to read unintended files on the filesystem.

There is no fixed version for flowise.

flowise is a Flowiseai Server

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the /api/v1/credentials/id endpoint, which returns a 404 page in the absence of a credential ID. An attacker can inject malicious scripts into the text/html page to read unintended files on the filesystem.

There is no fixed version for flowise.

flowise is a Flowiseai Server

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the api/v1/chatflows/id endpoint, which returns a 404 page in the absence of a chatflow ID. An attacker can inject malicious scripts into the text/html page to read unintended files on the filesystem.

There is no fixed version for flowise.

flowise is a Flowiseai Server

Affected versions of this package are vulnerable to Path Traversal due to improper sanitization of the filename parameter used by the /api/v1/openai-assistants-file endpoint. An attacker can pass in a path traversal string to read arbitrary files on the vulnerable file system.

There is no fixed version for flowise.

flowise is a Flowiseai Server

Affected versions of this package are vulnerable to Origin Validation Error due to the use of the Access-Control-Allow-Origin header being set to allow all origins by default. An attacker can expose information by making requests from unauthorized origins.

Upgrade flowise to version 1.4.12 or higher.