flowise@1.3.2 vulnerabilities

flowise is a Flowiseai Server

Affected versions of this package are vulnerable to Arbitrary File Upload via the file upload process. An attacker can store malicious files on the server by uploading files without proper validation of file type, extension, or content. This can result in the persistent presence of executable scripts, which may be triggered later to execute arbitrary commands on the server.

Upgrade flowise to version 3.0.8 or higher.

flowise is a Flowiseai Server

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via insufficient input filtering of input by web applications such as chat box and agent workflow processes. An attacker can execute arbitrary JavaScript code in the victim's browser by injecting malicious scripts, potentially leading to theft of sensitive information such as cookies when a user interacts with crafted content.

There is no fixed version for flowise.

flowise is a Flowiseai Server

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the workflow UI View Messages feature in the admin panel. An attacker can execute arbitrary JavaScript in the context of an administrator's browser by injecting a specially crafted payload through message input, leading to credential theft and exposure of sensitive information stored in localStorage.

Upgrade flowise to version 2.2.7-patch.1 or higher.

flowise is a Flowiseai Server

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the chat logs, due to improper input sanitization. An attacker can access sensitive information or impersonate an administrator by injecting malicious HTML or scripts into chat prompts, which are then rendered when an admin views the logs.

There is no fixed version for flowise.

flowise is a Flowiseai Server

Affected versions of this package are vulnerable to Missing Authentication for Critical Function via the forgot-password endpoint, which returns a valid password reset tempToken and sensitive user details without authentication or verification. An attacker can gain access to arbitrary user accounts, including privileged accounts, resulting in complete account takeover.

Upgrade flowise to version 3.0.6 or higher.

flowise is a Flowiseai Server

Affected versions of this package are vulnerable to SQL Injection: Hibernate via the importChatflows process. An attacker can execute arbitrary SQL commands by injecting malicious SQL code into the input parameters.

Upgrade flowise to version 2.2.8 or higher.

flowise is a Flowiseai Server

Affected versions of this package are vulnerable to Arbitrary Code Injection via the /api/v1/document-store/loader/process API. An attacker can execute arbitrary code by manipulating the fileName parameter to traverse directories and overwrite critical files such as package.json, leading to remote code execution when the server is started.

Note:

The writing functions addBase64FilesToStorage, addArrayFilesToStorage and addSingleFileToStorage in packages/components/src/storageUtils.ts are vulnerable.

Upgrade flowise to version 2.1.0 or higher.

flowise is a Flowiseai Server

Affected versions of this package are vulnerable to Arbitrary File Upload through the /api/v1/attachments endpoint. An attacker can upload malicious files to the server by sending specially crafted requests to this endpoint.

Note:

This is only exploitable if the server configuration allows file uploads without proper validation or sanitization.

Upgrade flowise to version 2.2.7-patch.1 or higher.

flowise is a Flowiseai Server

Affected versions of this package are vulnerable to External Control of System or Configuration Setting via the overrideConfig option. An attacker can execute arbitrary code, crash the server, perform server-side request forgery and exfiltrate server variables and data by injecting malicious configurations.

Upgrade flowise to version 2.1.4 or higher.

flowise is a Flowiseai Server

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) in the creation of a chatflow. An attacker can bypass input filters by providing a snippet without an event handler as input to a conversation, like <iframe src=javascript:console.log(document.domain)>. This input is passed on to the administration panel and executed.

Upgrade flowise to version 2.1.1 or higher.

flowise is a Flowiseai Server

Affected versions of this package are vulnerable to Uncontrolled Resource Consumption ('Resource Exhaustion') through the /api/v1/get-upload-file API endpoint. An attacker can cause the application to crash by sending specially crafted input.

There is no fixed version for flowise.

flowise is a Flowiseai Server

Affected versions of this package are vulnerable to Improper Authentication via the API endpoint authentication process. An attacker can gain unauthorized administrative access and manipulate restricted functionalities by bypassing the authentication mechanism.

Upgrade flowise to version 2.0.6 or higher.

flowise is a Flowiseai Server

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the /api/v1/public-chatflows/id endpoint, which returns a 404 page in the absence of a chatflow ID. An attacker can inject malicious scripts into the text/html page to read unintended files on the filesystem.

There is no fixed version for flowise.

flowise is a Flowiseai Server

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) through the /api/v1/chatflows-streaming/id, which returns a 404 page in the absence of a streaming ID. An attacker can inject malicious scripts into the text/html page to read unintended files on the filesystem.

There is no fixed version for flowise.

flowise is a Flowiseai Server

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the /api/v1/credentials/id endpoint, which returns a 404 page in the absence of a credential ID. An attacker can inject malicious scripts into the text/html page to read unintended files on the filesystem.

There is no fixed version for flowise.

flowise is a Flowiseai Server

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the api/v1/chatflows/id endpoint, which returns a 404 page in the absence of a chatflow ID. An attacker can inject malicious scripts into the text/html page to read unintended files on the filesystem.

There is no fixed version for flowise.

flowise is a Flowiseai Server

Affected versions of this package are vulnerable to Path Traversal due to improper sanitization of the filename parameter used by the /api/v1/openai-assistants-file endpoint. An attacker can pass in a path traversal string to read arbitrary files on the vulnerable file system.

There is no fixed version for flowise.

flowise is a Flowiseai Server

Affected versions of this package are vulnerable to Origin Validation Error due to the use of the Access-Control-Allow-Origin header being set to allow all origins by default. An attacker can expose information by making requests from unauthorized origins.

Upgrade flowise to version 1.4.12 or higher.