CVE-2024-36421
📋 TL;DR
Flowise version 1.4.3 has a CORS misconfiguration that allows arbitrary origins to connect to the website, potentially enabling cross-origin attacks. When combined with a path injection vulnerability, attackers can read arbitrary files from the Flowise server. All users running Flowise 1.4.3 in default unauthenticated configuration are affected.
💻 Affected Systems
- Flowise
📦 What is this software?
Flowise by Flowiseai
⚠️ Risk & Real-World Impact
Worst Case
Attackers can read sensitive files from the server including configuration files, credentials, and user data, leading to complete system compromise.
Likely Case
Unauthenticated attackers can exfiltrate sensitive information and potentially escalate to further attacks using stolen data.
If Mitigated
With proper CORS configuration and authentication, the attack surface is significantly reduced to authenticated users only.
🎯 Exploit Status
Exploitation requires chaining CORS misconfiguration with path injection, but both vulnerabilities are well-documented.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: None
Vendor Advisory: None
Restart Required: Yes
Instructions:
No official patch available. Monitor Flowise GitHub repository for security updates.
🔧 Temporary Workarounds
Implement Proper CORS Configuration
allRestrict Access-Control-Allow-Origin to trusted domains only instead of wildcard (*)
Modify packages/server/src/index.ts line 122 to set specific origins
Enable Authentication
allConfigure Flowise with authentication to prevent unauthenticated access
Set FLOWISE_USERNAME and FLOWISE_PASSWORD environment variables
🧯 If You Can't Patch
- Restrict network access to Flowise using firewall rules (only allow trusted IPs)
- Run Flowise behind a reverse proxy with proper CORS and security headers
🔍 How to Verify
Check if Vulnerable:
Check if Access-Control-Allow-Origin header is set to '*' in HTTP responses from Flowise serverCheck Version:
Check package.json for version or run: npm list flowiseVerify Fix Applied:
Verify CORS headers only allow specific trusted origins and authentication is enabled📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns
- Requests from unexpected origins
- Failed authentication attempts
Network Indicators:
- Cross-origin requests to Flowise endpoints
- File read attempts via path traversal
SIEM Query:
source="flowise" AND (http.header="Access-Control-Allow-Origin: *" OR path="../../")🔗 References
- https://github.com/FlowiseAI/Flowise/blob/e93ce07851cdc0fcde12374f301b8070f2043687/packages/server/src/index.ts#L122
- https://securitylab.github.com/advisories/GHSL-2023-232_GHSL-2023-234_Flowise/
- https://github.com/FlowiseAI/Flowise/blob/e93ce07851cdc0fcde12374f301b8070f2043687/packages/server/src/index.ts#L122
- https://securitylab.github.com/advisories/GHSL-2023-232_GHSL-2023-234_Flowise/
