Arbitrary Code Execution in AgentFlow via Local Python Pipeline Files

Executive Summary

AgentFlow contains an arbitrary code execution vulnerability that allows attackers to execute local Python pipeline files by supplying a user-controlled pipeline_path parameter to specific API endpoints.

Specifically, attackers can send requests to the POST /api/runs and POST /api/runs/validate endpoints with a crafted pipeline_path parameter, causing the system to load and execute existing Python pipeline files on disk.

This results in code execution within the context of the user running AgentFlow, potentially allowing attackers to run arbitrary code on the affected system.

Useful 0 Not Useful 0

Detection Guidance

Detection of this vulnerability involves monitoring for unauthorized or suspicious POST requests to the local AgentFlow API endpoints /api/runs and /api/runs/validate that include the pipeline_path parameter.

Since the vulnerable API accepts JSON requests with a user-controlled pipeline_path parameter, you can inspect network traffic or logs for such requests targeting these endpoints.

• Use network monitoring tools like tcpdump or Wireshark to filter HTTP POST requests to localhost on the AgentFlow port (default binding is 127.0.0.1).
• Example tcpdump command: tcpdump -i lo -A 'tcp port <AgentFlow_port> and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' | grep -i 'POST /api/runs'
• Check application logs for POST requests containing the pipeline_path parameter.
• Use curl or similar tools to test if the API accepts pipeline_path parameters, e.g.: curl -X POST -H 'Content-Type: application/json' -d '{"pipeline_path":"/path/to/file.py"}' http://127.0.0.1:<AgentFlow_port>/api/runs

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to arbitrary code execution on the system running AgentFlow.

An attacker exploiting this flaw could execute malicious Python code with the same privileges as the AgentFlow user, potentially leading to unauthorized access, data manipulation, system compromise, or further attacks within the environment.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows arbitrary code execution in the context of the user running AgentFlow by exploiting the pipeline_path parameter. This could lead to unauthorized access, data manipulation, or data breaches.

Such unauthorized code execution and potential data compromise can negatively impact compliance with common standards and regulations like GDPR and HIPAA, which require strict controls over data confidentiality, integrity, and access.

Mitigations such as disabling the pipeline_path parameter by default and requiring explicit opt-in for its use help reduce the risk, but if the vulnerability is exploited, it could result in violations of these regulatory requirements.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability immediately, ensure that your AgentFlow installation is updated to a version including the security hardening patch (commit 1667fa3 or later).

By default, the patched AgentFlow web API binds only to 127.0.0.1 and disables the pipeline_path parameter on the /api/runs and /api/runs/validate endpoints, preventing arbitrary code execution.

Avoid enabling the AGENTFLOW_API_ALLOW_PIPELINE_PATH environment variable unless you fully trust the environment and workflows, as this opt-in allows filesystem path loading.

• Update AgentFlow to the latest version containing the patch.
• Verify that the API is bound to localhost (127.0.0.1) only.
• Ensure that the pipeline_path parameter is disabled by default and not accepted in API requests.
• Implement network controls to restrict access to the AgentFlow API endpoints.

Useful 0 Not Useful 0