Missing Authorization Affecting langflow package, versions [,1.0.19)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-LANGFLOW-8320953
- published 1 Nov 2024
- disclosed 1 Nov 2024
- credit Unknown
How to fix?
Upgrade langflow to version 1.0.19 or higher.
Overview
langflow is an A Python package with a built-in web application
Affected versions of this package are vulnerable to Missing Authorization due to improper authorization checks to verify flow ownership in upload_file function in files.py file. To exploit this vulnerability, an attacker needs valid authentication credentials but does not require elevated privileges.
Note:
The attack can be carried out by sending file upload requests to the /api/v1/files/upload endpoint with a flow_id parameter corresponding to another user's flow.