CVE-2024-37014
📋 TL;DR
Langflow versions through 0.6.19 contain a remote code execution vulnerability in the custom component API endpoint. Attackers can execute arbitrary Python code by sending crafted POST requests to the '/api/v1/custom_component' endpoint. Any Langflow deployment accessible to untrusted users is affected.
💻 Affected Systems
- Langflow
📦 What is this software?
Langflow by Langflow
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attackers to execute arbitrary commands, install malware, exfiltrate data, or pivot to other systems.
Likely Case
Unauthorized code execution leading to data theft, service disruption, or lateral movement within the network.
If Mitigated
Limited impact if endpoint is properly restricted to trusted users only.
🎯 Exploit Status
Simple HTTP POST request with Python code payload can trigger exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.6.20 or later
Vendor Advisory: https://github.com/langflow-ai/langflow/issues/1973
Restart Required: Yes
Instructions:
1. Update Langflow to version 0.6.20 or later. 2. Restart the Langflow service. 3. Verify the update was successful.
🔧 Temporary Workarounds
Block Custom Component Endpoint
linuxRestrict access to the vulnerable API endpoint using network controls or web application firewall.
iptables -A INPUT -p tcp --dport [langflow-port] -m string --string "POST /api/v1/custom_component" --algo bm -j DROP
Implement Authentication
allAdd authentication requirements for all API endpoints if not already configured.
🧯 If You Can't Patch
- Isolate Langflow instances from internet and restrict network access to trusted IPs only.
- Implement strict input validation and sanitization for the custom component endpoint.
🔍 How to Verify
Check if Vulnerable:
Check Langflow version. If version is 0.6.19 or earlier, the system is vulnerable.Check Version:
Check Langflow web interface or configuration files for version information.Verify Fix Applied:
Verify Langflow version is 0.6.20 or later and test that custom component endpoint rejects malicious Python scripts.📡 Detection & Monitoring
Log Indicators:
- POST requests to /api/v1/custom_component endpoint
- Unusual Python execution errors
- Suspicious process creation
Network Indicators:
- HTTP POST requests to custom component endpoint with Python code payloads
- Unusual outbound connections from Langflow server
SIEM Query:
source="langflow" AND (url="/api/v1/custom_component" OR message="*custom_component*")