Authentication Bypass in Flowise via Unprotected Registration Endpoint

Executive Summary

This vulnerability is an authentication bypass in Flowise's /api/v1/account/register endpoint. It is unprotected, allowing unauthenticated attackers to create user accounts without any credentials.

Attackers can exploit this flaw to register arbitrary accounts and gain full API access to the system without needing to authenticate.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if the /api/v1/account/register endpoint is accessible without authentication and allows creation of user accounts.

You can use commands like curl to test this endpoint by attempting to register a new user without credentials.

• curl -X POST http://<target-ip-or-domain>/api/v1/account/register -d '{"username":"testuser","password":"testpass"}' -H "Content-Type: application/json"

If the request succeeds and a new user account is created without authentication, the system is vulnerable.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows attackers to bypass authentication and gain full API access by creating arbitrary user accounts.

This can lead to unauthorized access to sensitive data or system functions, potentially compromising the security and integrity of the affected system.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows unauthenticated attackers to create arbitrary user accounts and gain full API access without credentials, which can lead to unauthorized access to sensitive data and systems.

Such unauthorized access could result in violations of common standards and regulations like GDPR and HIPAA, which require strict access controls and protection of personal and sensitive information.

Therefore, exploitation of this vulnerability may compromise compliance by exposing systems to unauthorized data access and potential data breaches.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting access to the /api/v1/account/register endpoint to authenticated users only or disabling the endpoint if registration is not required.

Since no patches are currently available, you should implement network-level controls such as firewall rules or API gateway policies to block unauthenticated requests to this endpoint.

Monitor logs for any unauthorized account creation attempts and consider temporarily disabling new user registrations until a fix is released.

Useful 0 Not Useful 0