GitHub Security Advisory: GHSA-mq4r-h2gh-qv7x
Package: flowise (NPM)
Severity: HIGH (CVSS 7.7)
CWE: CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes
Vulnerable versions: <= 3.0.12
Patched in: 3.0.13

Summary: Flowise Allows Mass Assignment in `/api/v1/leads` Endpoint

Details:
## Summary

**A Mass Assignment vulnerability in the `/api/v1/leads` endpoint allows any unauthenticated user to control internal entity fields (`id`, `createdDate`, `chatId`) by including them in the request body.**

The endpoint uses `Object.assign()` to copy all properties from the request body to the Lead entity without any input validation or field filtering. This allows attackers to bypass auto-generated fields and inject arbitrary values.

| Field | Value |
|-------|-------|
| **Vulnerability Type** | Mass Assignment |
| **CWE ID** | [CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes](https://cwe.mitre.org/data/definitions/915.html) |
| **Authentication Required** | None |
| **Affected Endpoint** | `POST /api/v1/leads` |


---

## Details

### Root Cause

The vulnerability exists in `/packages/server/src/services/leads/index.ts` at lines 27-28:

```typescript
// File: /packages/server/src/services/leads/index.ts
// Lines 23-38

const createLead = async (body: Partial<ILead>) => {
    try {
        const chatId = body.chatId ?? uuidv4()

        const newLead = new Lead()
        Object.assign(newLead, body)  // ← VULNERABILITY: All properties copied!
        Object.assign(newLead, { chatId })

        const appServer = getRunningExpressApp()
        const lead = appServer.AppDataSource.getRepository(Lead).create(newLead)
        const dbResponse = await appServer.AppDataSource.getRepository(Lead).save(lead)
        return dbResponse
    } catch (error) {
        throw new InternalFlowiseError(...)
    }
}
```

The `Object.assign(newLead, body)` on line 28 copies **ALL** properties from the request body to the Lead entity, including:
- `id` - The primary key (should be auto-generated)
- `createdDate` - The creation timestamp (should be auto-generated)
- `chatId` - The chat identifier

### Lead Entity Definition

The Lead entity at `/packages/server/src/database/entities/Lead.ts` uses TypeORM decorators that should auto-generate these fields:

```typescript
// File: /packages/server/src/database/entities/Lead.ts

@Entity()
export class Lead implements ILead {
    @PrimaryGeneratedColumn('uuid')  // Should be auto-generated!
    id: string

    @Column()
    name?: string

    @Column()
    email?: string

    @Column()
    phone?: string

    @Column()
    chatflowid: string

    @Column()
    chatId: string

    @CreateDateColumn()  // Should be auto-generated!
    createdDate: Date
}
```

However, `Object.assign()` overwrites these fields before they are saved, bypassing the auto-generation.

### Why the Endpoint is Publicly Accessible

The `/api/v1/leads` endpoint is whitelisted in `/packages/server/src/utils/constants.ts`:

```typescript
// File: /packages/server/src/utils/constants.ts
// Line 20

export const WHITELIST_URLS = [
    // ... other endpoints ...
    '/api/v1/leads',  // ← No authentication required
    // ... more endpoints ...
]
```

---

## Proof of Concept

<img width="1585" height="