Flowise Unverified Password Change Leading to Account Takeover

Executive Summary

This vulnerability exists in Flowise versions before 3.0.10 and involves an unverified password change feature. An authenticated user can change their account password through the account settings without needing to provide their current password or any other form of verification.

Because the application does not enforce a current-password check when changing credentials, an attacker who can hijack or coerce an authenticated session can exploit this to take over the account completely.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves an authenticated user being able to change their password without supplying the current password or additional verification. Detection would involve monitoring for password change requests that do not require current password verification.

Since the vulnerability is in the account settings (Security) section of Flowise before version 3.0.10, you can detect exploitation attempts by inspecting logs or network traffic for password change requests that lack the current password field.

No specific commands are provided in the available resources to detect this vulnerability on your system or network.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to a full account takeover if an attacker gains access to an authenticated session. The attacker can change the account password without knowing the original password, effectively locking out the legitimate user and gaining unauthorized access to the account.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows an authenticated user to change their account password without supplying the current password or any additional verification, leading to potential full account takeover.

This can result in loss of confidentiality and integrity of account data, which may impact compliance with standards and regulations such as GDPR and HIPAA that require protection of user data and secure authentication mechanisms.

By enabling unauthorized account takeover, the vulnerability could lead to unauthorized access to personal or sensitive information, thereby violating data protection requirements and potentially causing non-compliance with these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade Flowise to version 3.0.10 or later, where this vulnerability has been patched.

Until the upgrade can be applied, restrict access to the account settings (Security) section to trusted users only and monitor authenticated sessions for suspicious activity.

Additionally, consider implementing additional verification mechanisms for password changes if possible, such as requiring the current password or multi-factor authentication.

Useful 0 Not Useful 0