| शीर्षक | FlowiseAI Flowise 3.0.1 => affected<=3.0.2 SSRF |
|---|
| विवरण | The Flowise evaluations feature constructs the base URL for its outbound prediction requests directly from client-controlled HTTP request headers (Host and X-Forwarded-Proto). This value flows unvalidated into an axios.post() call inside EvaluationRunner, allowing an authenticated user to coerce the server into issuing HTTP POST requests to an arbitrary host of their choosing. When the evaluated chatflow has an API key configured, that key is transmitted in an Authorization: Bearer header to the attacker-chosen destination. |
|---|
| स्रोत | ⚠️ https://github.com/FlowiseAI/Flowise/issues/6687 |
|---|
| उपयोगकर्ता | ZAST.AI (UID 87884) |
|---|
| सबमिशन | 02/08/2026 04:25 PM (1 महीना पहले) |
|---|
| संयम | 12/09/2026 06:41 PM (1 month later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 403165 [FlowiseAI Flowise तक 3.0.2 Evaluations Endpoint index.ts axios.post Host/X-Forwarded-Proto अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|