CVE-2024-36421

Flowise is a drag & drop user interface to build a customized large language model flow. In version 1.4.3 of Flowise, A CORS misconfiguration sets the Access-Control-Allow-Origin header to all, allowing arbitrary origins to connect to the website. In the default configuration (unauthenticated), arbitrary origins may be able to make requests to Flowise, stealing information from the user. This CORS misconfiguration may be chained with the path injection to allow an attacker attackers without access to Flowise to read arbitrary files from the Flowise server. As of time of publication, no known patches are available.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/FlowiseAI/Flowise/blob/e93ce07851cdc0fcde12374f301b8070f2043687/packages/server/src/index.ts#L122	Product
https://securitylab.github.com/advisories/GHSL-2023-232_GHSL-2023-234_Flowise/	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:flowiseai:flowise:1.4.3:*:*:*:*:*:*:*

History

No history.

Information

Published : 2024-07-01 16:15

Updated : 2024-07-03 15:36

NVD link : CVE-2024-36421

Mitre link : CVE-2024-36421

CVE.ORG link : CVE-2024-36421

JSON object : View

Products Affected

flowiseai

flowise

CWE

CWE-346

Origin Validation Error

{"id": "CVE-2024-36421", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2024-07-01T16:15:04.623", "references": [{"url": "https://github.com/FlowiseAI/Flowise/blob/e93ce07851cdc0fcde12374f301b8070f2043687/packages/server/src/index.ts#L122", "tags": ["Product"], "source": "security-advisories@github.com"}, {"url": "https://securitylab.github.com/advisories/GHSL-2023-232_GHSL-2023-234_Flowise/", "tags": ["Exploit", "Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-346"}]}, {"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-346"}]}], "descriptions": [{"lang": "en", "value": "Flowise is a drag & drop user interface to build a customized large language model flow. In version 1.4.3 of Flowise, A CORS misconfiguration sets the Access-Control-Allow-Origin header to all, allowing arbitrary origins to connect to the website. In the default configuration (unauthenticated), arbitrary origins may be able to make requests to Flowise, stealing information from the user. This CORS misconfiguration may be chained with the path injection to allow an attacker attackers without access to Flowise to read arbitrary files from the Flowise server. As of time of publication, no known patches are available."}, {"lang": "es", "value": "Flowise es una interfaz de usuario de arrastrar y soltar para crear un flujo de modelo de lenguaje grande personalizado. En la versi\u00f3n 1.4.3 de Flowise, una mala configuraci\u00f3n de CORS establece el encabezado Access-Control-Allow-Origin en todos, lo que permite que or\u00edgenes arbitrarios se conecten al sitio web. En la configuraci\u00f3n predeterminada (no autenticado), or\u00edgenes arbitrarios pueden realizar solicitudes a Flowise, robando informaci\u00f3n del usuario. Esta configuraci\u00f3n err\u00f3nea de CORS puede estar encadenada con la inyecci\u00f3n de ruta para permitir que un atacante sin acceso a Flowise lea archivos arbitrarios del servidor Flowise. Al momento de la publicaci\u00f3n, no hay parches conocidos disponibles."}], "lastModified": "2024-07-03T15:36:31.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:flowiseai:flowise:1.4.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "46DEFB82-D429-4A21-A963-B9DD1EB58AD5"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}