AgentFlow Local Web API Content-Type Validation Bypass

Executive Summary

AgentFlow's local web API does not enforce that POST requests to the /api/runs and /api/runs/validate endpoints use the application/json content type. This means it accepts other content types without proper validation.

Because of this, attackers can bypass trust-boundary enforcement on sensitive operations by exploiting this weakness in content-type validation.

Attackers can use browser-driven or local cross-origin requests to abuse the localhost API, potentially enabling attack chains against the local control plane.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if the AgentFlow local web API endpoints /api/runs and /api/runs/validate accept POST requests with non-JSON content types without rejecting them.

You can test this by sending POST requests to these endpoints with content types other than application/json and observe if the server accepts them or returns an HTTP 415 Unsupported Media Type error.

For example, using curl commands:

• curl -X POST http://localhost:port/api/runs -H "Content-Type: text/plain" -d 'test data' -v
• curl -X POST http://localhost:port/api/runs/validate -H "Content-Type: text/plain" -d 'test data' -v

If the server accepts these requests without returning a 415 error, it indicates the vulnerability is present.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to bypass security controls on sensitive operations by exploiting the lack of content-type validation.

As a result, attackers can perform unauthorized actions on the local control plane through the localhost API.

This can lead to potential compromise or manipulation of local system operations that rely on the AgentFlow API.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability in AgentFlow's local web API allows attackers to bypass trust-boundary enforcement on sensitive operations by exploiting a content-type validation weakness. This could enable unauthorized access or manipulation of local control plane operations.

Such unauthorized access and potential abuse of sensitive operations could lead to violations of data protection and security requirements mandated by common standards and regulations like GDPR and HIPAA, which require strict control over access to sensitive data and systems.

However, the provided information does not explicitly detail the direct impact on compliance with these standards or any specific regulatory consequences.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include applying the patch that enforces strict content-type validation on the affected endpoints.

• Ensure the AgentFlow web API only accepts requests with the application/json content type on POST /api/runs and POST /api/runs/validate endpoints, rejecting others with HTTP 415 errors.
• Disable the use of the pipeline_path parameter by default to prevent execution of arbitrary local pipeline files.
• Restrict the AgentFlow server to bind only to localhost (127.0.0.1) to limit exposure.
• If pipeline_path functionality is required, explicitly enable it by setting the environment variable AGENTFLOW_API_ALLOW_PIPELINE_PATH=1, but only in trusted environments.

These steps restore the intended trust boundary and prevent abuse of the local control plane.

Useful 0 Not Useful 0