GHSA-cvrr-qhgw-2mm6 Flowise: Parameter Override Bypass Remote Command Execution
SummaryFlowise is vulnerable to a critical unauthenticated remote command execution (RCE) vulnerability. It can be exploited via a parameter override bypass using the `FILE-STORAGE::` keyword combined with a `NODE_OPTIONS` environment variable injection. This allows for the execution of arbitrary system commands with root privileges within the containerized Flowise instance, requiring only a single HTTP request and no authentication or knowledge of the instance.DetailsThe vulnerability is in a validation check within the `replaceInputsWithConfig` function within `packages/server/src/utils/index.ts`. The check for `FILE-STORAGE::` was intended to handle file-type inputs but has three issues:Uses .includes() instead of .startsWith(): The check passes if FILE-STORAGE:: appears ANYWHERE in the string, not just at the beginning. A remote user can embed it in a comment: /* FILE-STORAGE:: */ { custom config }No parameter type validation: The check doesn't verify that the parameter is actually a file-type input. It applies to ANY parameter name, including mcpServerConfig.Complete bypass, not partial: When the check passes, it skips the isParameterEnabled() call entirely, allowing modification of parameters that administrators never authorized.**Vulnerable Code (`FILE-STORAGE::` bypass):**This bypass allows an attacker to override the `mcpServerConfig` and inject a malicious `NODE_OPTIONS` value. The `Custom MCP` node's environment variable blocklist does not include `NODE_OPTIONS`, enabling an attacker to use the `--experimental-loader` to execute arbitrary JavaScript code before the main process starts.**Vulnerable Code (`NODE_OPTIONS` not blocked):**Requirements**API Override Enabled**
The chatflow must have "API Override" toggled ON in Chatflow Configuration.
**Public Chatflow**
The chatflow must be shared publicly.
**MCP Node**
The chatflow must contain a MCP tool node (Custom MCP tool was tested and confirmed).Although not enabled by default, the API Override feature is a powerful and officially documented capability that may be used in production deployments. Its primary purpose is to make chatflows dynamic and user-aware.Common use cases that necessitate enabling this feature include:**Session Management:** Passing a unique `sessionId` or `chatId` for each user to maintain separate conversation histories.**User-Specific Variables:** Injecting user data such as name, preferences, or role into prompts to create personalized experiences.**Dynamic Tool Selection:** Allowing users to specify which data sources or APIs to query based on their needs.**Multi-Tenant Applications:** Supporting different configurations for each customer or organization without deploying separate chatflows.**A/B Testing:** Evaluating different prompts or models in a live environment.SetupTo reproduce the vulnerability, follow these steps:**Step 1: Start Flowise Instance****Step 2: Configure a Public Chatflow with MCP Tool**Navigate to `http://localhost:3000` and create an account.Create a new chatflow.Add a `Custom MCP` node and a `Custom JS Function` node.Connect the `Custom MCP` output to the `Custom JS Function`'s tools input.Configure the `Custom JS Function` to be an `Ending Node` with the code: `return $tools ? "Tools loaded" : "No tools";`Configure the `Custom MCP` with the MCP Server Config: `{"command":"npx","args":["-y","@modelcontextprotocol/server-everything"]}`Save the chatflow and note the `chatflowId` from the URL.In Chatflow Configuration, **enable API Override** and make the chatflow **Public**.PoCSingle-Request RCE with remote command output retrieval. The following demonstrates arbitrary command execution with automatic data transmission to a remote listener:Step 1: Setup ListenerStep 2: Trigger ExploitStep 3: Verify Command ExecutionImpactThis vulnerability allows for:**Full Container Compromise:** Arbitrary command execution as the root user.**Data Exfiltration:** Access to all secrets, credentials, and user data within the container.**Lateral Movement:** A pivot point for attacking internal networks and other connected systems.The exploit requires no prior authentication, no specific knowledge of the target instance, and is executed with a single HTTP POST request, making it a critical and easily exploitable vulnerability.CreditJeremy Brown
CVSS v3.0 score: 7.7