GHSA-H42X-XX2Q-6V6G
Vulnerability from github – Published: 2025-03-13 22:38 – Updated: 2025-03-13 22:38
VLAI
Summary
Flowise Pre-auth Arbitrary File Upload
Details
Summary
An unauthorized attacker can leverage the whitelisted route /api/v1/attachments to upload arbitrary files when the storageType is set to local (default).
Details
When a new request arrives, the system first checks if the URL starts with /api/v1/. If it does, the system then verifies whether the URL is included in the whitelist (whitelistURLs). If the URL is whitelisted, the request proceeds; otherwise, the system enforces authentication.
@ /packages/server/src/index.ts
this.app.use(async (req, res, next) => {
// Step 1: Check if the req path contains /api/v1 regardless of case
if (URL_CASE_INSENSITIVE_REGEX.test(req.path)) {
// Step 2: Check if the req path is case sensitive
if (URL_CASE_SENSITIVE_REGEX.test(req.path)) {
// Step 3: Check if the req path is in the whitelist
const isWhitelisted = whitelistURLs.some((url) => req.path.startsWith(url))
if (isWhitelisted) {
next()
} else if (req.headers['x-request-from'] === 'internal') {
basicAuthMiddleware(req, res, next)
} else {
const isKeyValidated = await validateAPIKey(req)
if (!isKeyValidated) {
return res.status(401).json({ error: 'Unauthorized Access' })
}
next()
}
} else {
return res.status(401).json({ error: 'Unauthorized Access' })
}
} else {
// If the req path does not contain /api/v1, then allow the request to pass through, example: /assets, /canvas
next()
}
}
The whitelist is defined as follows
export const WHITELIST_URLS = [
'/api/v1/verify/apikey/',
'/api/v1/chatflows/apikey/',
'/api/v1/public-chatflows',
'/api/v1/public-chatbotConfig',
'/api/v1/prediction/',
'/api/v1/vector/upsert/',
'/api/v1/node-icon/',
'/api/v1/components-credentials-icon/',
'/api/v1/chatflows-streaming',
'/api/v1/chatflows-uploads',
'/api/v1/openai-assistants-file/download',
'/api/v1/feedback',
'/api/v1/leads',
'/api/v1/get-upload-file',
'/api/v1/ip',
'/api/v1/ping',
'/api/v1/version',
'/api/v1/attachments',
'/api/v1/metrics'
]
This means that every route in the whitelist does not require authentication. Now, let's examine the /api/v1/attachments route.
@ /packages/server/src/routes/attachments/index.ts
const router = express.Router()
// CREATE
router.post('/:chatflowId/:chatId', getMulterStorage().array('files'), attachmentsController.createAttachment)
export default router
After several calls, the request reaches the createFileAttachment function @ (packages/server/src/utils/createAttachment.ts)
Initially, the function retrieves chatflowid and chatId from the request without any additional validation. The only check performed is whether these parameters exist in the request.
const chatflowid = req.params.chatflowId
if (!chatflowid) {
throw new Error(
'Params chatflowId is required! Please provide chatflowId and chatId in the URL: /api/v1/attachments/:chatflowId/:chatId'
)
}
const chatId = req.params.chatId
if (!chatId) {
throw new Error(
'Params chatId is required! Please provide chatflowId and chatId in the URL: /api/v1/attachments/:chatflowId/:chatId'
)
}
Next, the function retrieves the uploaded files and attempts to add them to the storage by calling the addArrayFilesToStorage function.
const files = (req.files as Express.Multer.File[]) || []
const fileAttachments = []
if (files.length) {
// ...
for (const file of files) {
const fileBuffer = await getFileFromUpload(file.path ?? file.key) // get the uploaded file
const fileNames: string[] = []
file.originalname = Buffer.from(file.originalname, 'latin1').toString('utf8')
// add it to the storage
const storagePath = await addArrayFilesToStorage(file.mimetype,
fileBuffer,
file.originalname,
fileNames,
chatflowid, chatId) // add it to the storage
// ...
await removeSpecificFileFromUpload(file.path ?? file.key) // delete from tmp
// ...
fileAttachments.push({
name: file.originalname,
mimeType: file.mimetype,
size: file.size,
content
})
} catch (error) {
throw new Error(`Failed operation: createFileAttachment - ${getErrorMessage(error)}`)
}
}
}
return fileAttachments
Now lets take a look at addArrayFilesToStorage function @ (/packages/components/src/storageUtils.ts)
export const addArrayFilesToStorage = async (mime: string, bf: Buffer, fileName: string, fileNames: string[], ...paths: string[]) => {
const storageType = getStorageType()
const sanitizedFilename = _sanitizeFilename(fileName)
if (storageType === 's3') {
// ...
} else {
const dir = path.join(getStoragePath(), ...paths) // PATH TRAVERSAL.
if (!fs.existsSync(dir)) {
fs.mkdirSync(dir, { recursive: true })
}
const filePath = path.join(dir, sanitizedFilename)
fs.writeFileSync(filePath, bf)
fileNames.push(sanitizedFilename)
return 'FILE-STORAGE::' + JSON.stringify(fileNames)
}
}
As noted in the comment, to construct the directory, the function joins the output of the getStoragePath function with ...paths, which are essentially the chatflowid and chatId extracted earlier from the request.
However, as mentioned previously, these values are not validated to ensure they are UUIDs or numbers. As a result, an attacker could manipulate these variables to set the dir variable to any value.
Combined with the fact that the filename is also provided by the user, this leads to unauthenticated arbitrary file upload.
POC
This is the a HTTP request. As observed, we are not authenticated, and by manipulating the chatId parameter, we can perform a path traversal. In this example, we overwrite the api.json file, which contains the API keys for the system.
in this example, the dir variable will be
var dir = '/root/.flowise/storage/test/../../../../../../../../root/.flowise/'
and the file name is
api.json
And the API Keys in the UI
Impact
This vulnerability could potentially lead to * Remote Code Execution * Server Takeover * Data Theft And more
Severity
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "flowise"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "2.2.7"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-434"
],
"github_reviewed": true,
"github_reviewed_at": "2025-03-13T22:38:03Z",
"nvd_published_at": null,
"severity": "CRITICAL"
},
"details": "## Summary\nAn unauthorized attacker can leverage the whitelisted route `/api/v1/attachments` to upload arbitrary files when the `storageType` is set to **local** (default).\n\n## Details\nWhen a new request arrives, the system first checks if the URL starts with `/api/v1/`. If it does, the system then verifies whether the URL is included in the whitelist (*whitelistURLs*). If the URL is whitelisted, the request proceeds; otherwise, the system enforces authentication.\n\n@ */packages/server/src/index.ts*\n```typescript\n this.app.use(async (req, res, next) =\u003e {\n // Step 1: Check if the req path contains /api/v1 regardless of case\n if (URL_CASE_INSENSITIVE_REGEX.test(req.path)) {\n // Step 2: Check if the req path is case sensitive\n if (URL_CASE_SENSITIVE_REGEX.test(req.path)) {\n // Step 3: Check if the req path is in the whitelist\n const isWhitelisted = whitelistURLs.some((url) =\u003e req.path.startsWith(url))\n if (isWhitelisted) {\n next()\n } else if (req.headers[\u0027x-request-from\u0027] === \u0027internal\u0027) {\n basicAuthMiddleware(req, res, next)\n } else {\n const isKeyValidated = await validateAPIKey(req)\n if (!isKeyValidated) {\n return res.status(401).json({ error: \u0027Unauthorized Access\u0027 })\n }\n next()\n }\n } else {\n return res.status(401).json({ error: \u0027Unauthorized Access\u0027 })\n }\n } else {\n // If the req path does not contain /api/v1, then allow the request to pass through, example: /assets, /canvas\n next()\n }\n }\n```\n\n**The whitelist is defined as follows**\n\n```typescript\nexport const WHITELIST_URLS = [\n \u0027/api/v1/verify/apikey/\u0027,\n \u0027/api/v1/chatflows/apikey/\u0027,\n \u0027/api/v1/public-chatflows\u0027,\n \u0027/api/v1/public-chatbotConfig\u0027,\n \u0027/api/v1/prediction/\u0027,\n \u0027/api/v1/vector/upsert/\u0027,\n \u0027/api/v1/node-icon/\u0027,\n \u0027/api/v1/components-credentials-icon/\u0027,\n \u0027/api/v1/chatflows-streaming\u0027,\n \u0027/api/v1/chatflows-uploads\u0027,\n \u0027/api/v1/openai-assistants-file/download\u0027,\n \u0027/api/v1/feedback\u0027,\n \u0027/api/v1/leads\u0027,\n \u0027/api/v1/get-upload-file\u0027,\n \u0027/api/v1/ip\u0027,\n \u0027/api/v1/ping\u0027,\n \u0027/api/v1/version\u0027,\n \u0027/api/v1/attachments\u0027,\n \u0027/api/v1/metrics\u0027\n]\n```\nThis means that every route in the whitelist does not require authentication. Now, let\u0027s examine the `/api/v1/attachments` route.\n\n@ */packages/server/src/routes/attachments/index.ts*\n```typescript\nconst router = express.Router()\n// CREATE\nrouter.post(\u0027/:chatflowId/:chatId\u0027, getMulterStorage().array(\u0027files\u0027), attachmentsController.createAttachment)\nexport default router\n```\nAfter several calls, the request reaches the `createFileAttachment` function @ (*packages/server/src/utils/createAttachment.ts*)\nInitially, the function retrieves *chatflowid* and *chatId* from the request without any additional validation. The only check performed is whether these parameters exist in the request.\n\n```typescript\n const chatflowid = req.params.chatflowId\n if (!chatflowid) {\n throw new Error(\n \u0027Params chatflowId is required! Please provide chatflowId and chatId in the URL: /api/v1/attachments/:chatflowId/:chatId\u0027\n )\n }\n\n const chatId = req.params.chatId\n if (!chatId) {\n throw new Error(\n \u0027Params chatId is required! Please provide chatflowId and chatId in the URL: /api/v1/attachments/:chatflowId/:chatId\u0027\n )\n }\n```\n\nNext, the function retrieves the uploaded files and attempts to add them to the storage by calling the `addArrayFilesToStorage` function.\n\n```typescript\nconst files = (req.files as Express.Multer.File[]) || []\n const fileAttachments = []\n if (files.length) {\n // ...\n for (const file of files) {\n const fileBuffer = await getFileFromUpload(file.path ?? file.key) // get the uploaded file\n const fileNames: string[] = []\n file.originalname = Buffer.from(file.originalname, \u0027latin1\u0027).toString(\u0027utf8\u0027)\n // add it to the storage\n const storagePath = await addArrayFilesToStorage(file.mimetype, \n fileBuffer,\n file.originalname,\n fileNames,\n chatflowid, chatId) // add it to the storage\n\n // ...\n\n await removeSpecificFileFromUpload(file.path ?? file.key) // delete from tmp\n // ...\n\n fileAttachments.push({\n name: file.originalname,\n mimeType: file.mimetype,\n size: file.size,\n content\n })\n } catch (error) {\n throw new Error(`Failed operation: createFileAttachment - ${getErrorMessage(error)}`)\n }\n }\n }\n\n return fileAttachments\n```\n\nNow lets take a look at `addArrayFilesToStorage` function @ (*/packages/components/src/storageUtils.ts*)\n\n```typescript\nexport const addArrayFilesToStorage = async (mime: string, bf: Buffer, fileName: string, fileNames: string[], ...paths: string[]) =\u003e {\n const storageType = getStorageType()\n\n const sanitizedFilename = _sanitizeFilename(fileName)\n if (storageType === \u0027s3\u0027) {\n // ...\n } else {\n const dir = path.join(getStoragePath(), ...paths) // PATH TRAVERSAL.\n if (!fs.existsSync(dir)) {\n fs.mkdirSync(dir, { recursive: true })\n }\n const filePath = path.join(dir, sanitizedFilename)\n fs.writeFileSync(filePath, bf)\n fileNames.push(sanitizedFilename)\n return \u0027FILE-STORAGE::\u0027 + JSON.stringify(fileNames)\n }\n}\n```\n\nAs noted in the comment, to construct the directory, the function joins the output of the `getStoragePath` function with `...paths`, which are essentially the `chatflowid` and `chatId` extracted earlier from the request.\nHowever, as mentioned previously, these values are not validated to ensure they are UUIDs or numbers. As a result, an attacker could manipulate these variables to set the **dir** variable to any value.\nCombined with the fact that the filename is also provided by the user, this leads to **unauthenticated arbitrary file upload**.\n\n## POC\nThis is the a HTTP request. As observed, we are not authenticated, and by manipulating the `chatId` parameter, we can perform a path traversal. In this example, we overwrite the `api.json` file, which contains the API keys for the system.\n\n\n\n\u003e in this example, the **dir** variable will be\n```typescript\nvar dir = \u0027/root/.flowise/storage/test/../../../../../../../../root/.flowise/\u0027\n```\n\u003e and the file name is `api.json`\n\nAnd the API Keys in the UI\n\n\n\n### Impact\nThis vulnerability could potentially lead to\n* Remote Code Execution\n* Server Takeover\n* Data Theft\nAnd more",
"id": "GHSA-h42x-xx2q-6v6g",
"modified": "2025-03-13T22:38:03Z",
"published": "2025-03-13T22:38:03Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-h42x-xx2q-6v6g"
},
{
"type": "WEB",
"url": "https://github.com/FlowiseAI/Flowise/commit/c2b830f279e454e8b758da441016b2234f220ac7"
},
{
"type": "PACKAGE",
"url": "https://github.com/FlowiseAI/Flowise"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Flowise Pre-auth Arbitrary File Upload"
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…