FlowiseAI Flowise up to 1.4.3 404 Page api/v1/chatflows/id cross site scripting

Summaryinfo

A vulnerability classified as problematic has been found in FlowiseAI Flowise up to 1.4.3. Affected is an unknown function of the file api/v1/chatflows/id of the component 404 Page. This manipulation causes cross site scripting. This vulnerability is registered as CVE-2024-36422. Remote exploitation of the attack is possible. No exploit is available.

Detailsinfo

A vulnerability was found in FlowiseAI Flowise up to 1.4.3. It has been declared as problematic. Affected by this vulnerability is some unknown processing of the file api/v1/chatflows/id of the component 404 Page. The manipulation with an unknown input leads to a cross site scripting vulnerability. The CWE definition for the vulnerability is CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. As an impact it is known to affect integrity. The summary by CVE is:

Flowise is a drag & drop user interface to build a customized large language model flow. In version 1.4.3 of Flowise, a reflected cross-site scripting vulnerability occurs in the `api/v1/chatflows/id` endpoint. If the default configuration is used (unauthenticated), an attacker may be able to craft a specially crafted URL that injects Javascript into the user sessions, allowing the attacker to steal information, create false popups, or even redirect the user to other websites without interaction. If the chatflow ID is not found, its value is reflected in the 404 page, which has type text/html. This allows an attacker to attach arbitrary scripts to the page, allowing an attacker to steal sensitive information. This XSS may be chained with the path injection to allow an attacker without direct access to Flowise to read arbitrary files from the Flowise server. As of time of publication, no known patches are available.

It is possible to read the advisory at securitylab.github.com. This vulnerability is known as CVE-2024-36422 since 05/27/2024. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1059.007 according to MITRE ATT&CK.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• FlowiseAI

Name

• Flowise

Version

• 1.4.0
• 1.4.1
• 1.4.2
• 1.4.3

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion