GHSA-6r77-hqx7-7vw8: Flowise:  APIChain Prompt Injection SSRF in GET/POST API Chains
SummaryA Server-Side Request Forgery (SSRF) vulnerability exists in FlowiseAI's POST/GET API Chain components that allows unauthenticated attackers to force the server to make arbitrary HTTP requests to internal and external systems. By injecting malicious prompt templates, attackers can bypass the intended API documentation constraints and redirect requests to sensitive internal services, potentially leading to internal network reconnaissance and data exfiltration.DetailsThe vulnerability is located in FlowiseAI's API Chain implementation where user-controlled input is used to dynamically generate URLs and request parameters without proper validation. The attack works as follows:Dynamic API Generation: Flowise's POST/GET API chains use LLM-generated prompts based on user queries and API documentation to construct HTTP requestsUnvalidated URL Construction: The system extracts URL and data parameters directly from LLM responses without validating against the intended API documentationSSRF Exploitation: Attackers can inject custom API documentation prompts that override the legitimate BASE URL, directing requests to arbitrary internal or external endpointsThe vulnerable code in `packages/components/nodes/chains/ApiChain/postCore.ts` processes user input without validation:The system trusts the LLM to generate valid URLs based on the API documentation, but since the API documentation itself can be manipulated through prompt injection, attackers can provide fake documentation that points to internal services:This malicious prompt causes the chain to make requests to `http://host.docker.internal:8080/flag` instead of the intended external API, allowing attackers to probe internal services, access cloud metadata endpoints, or interact with internal APIs that should not be externally accessible.The vulnerability affects both GET and POST API chains and can be exploited without authentication, making internal network resources accessible to remote attackers.PoC**Prerequisites:**FlowiseAI instance ≤ version 2.2.1Network access to the FlowiseAI API endpointsInternal test service for demonstration (provided in PoC)**Exploitation Steps:**Set up a test internal service using the provided Flask application:Create a Flowise chatflow with POST/GET API Chain componentSend malicious prompt that overrides the API documentation:Observe the internal service receiving the SSRF request:Alternative payload for accessing internal user services:The PoC demonstrates that the Flowise server makes HTTP requests to the attacker-controlled internal endpoints, confirming successful SSRF exploitation. Attackers can use this technique to:Scan internal network services and identify running applicationsAccess cloud metadata endpoints (AWS, Azure, GCP) to retrieve credentialsInteract with internal APIs that lack proper authenticationBypass firewall restrictions to access internal resourcesImpactThis SSRF vulnerability allows unauthenticated attackers to abuse the FlowiseAI server as a proxy to make HTTP requests to arbitrary internal and external endpoints, leading to:Internal Network Reconnaissance: Ability to scan and map internal network services, ports, and applications that are not exposed to the internetCloud Metadata Access: Potential access to cloud provider metadata services that may contain temporary credentials and sensitive configuration dataInternal Service Exploitation: Interaction with internal APIs, databases, and services that trust requests originating from the Flowise serverData Exfiltration: Access to sensitive internal data through compromised internal servicesBypassing Security Controls: Circumvention of firewall rules and network segmentation by using the Flowise server as a pivot point
CVSS v3.0: 7.1