Unauthenticated Arbitrary File Upload in Flowise

Executive Summary

This vulnerability exists in Flowise version 2.2.4 and involves an unauthenticated arbitrary file upload through the /api/v1/attachments endpoint when the storageType is set to local.

Attackers can exploit path traversal weaknesses in the chatId and chatflowId parameters to upload malicious files to arbitrary directories on the server.

This can potentially allow attackers to execute remote code and compromise the server.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to severe security impacts including remote code execution and full server compromise.

An attacker exploiting this flaw could upload malicious files without authentication, potentially gaining control over the affected system.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows unauthenticated attackers to upload malicious files to arbitrary directories, potentially leading to remote code execution, server compromise, and data theft.

Such a compromise can result in unauthorized access to sensitive data, which may violate data protection regulations like GDPR and HIPAA that require safeguarding personal and health information.

Because the vulnerability impacts confidentiality, integrity, and availability of data, it poses a significant risk to compliance with these standards, which mandate strict controls to prevent unauthorized data access and ensure system security.

Useful 0 Not Useful 0

Detection Guidance

Detection of this vulnerability involves monitoring for unauthorized or suspicious file uploads to the /api/v1/attachments endpoint, especially when the storageType parameter is set to local.

Since the vulnerability exploits path traversal in the chatId and chatflowId parameters, you can look for unusual requests containing traversal patterns such as '../' or encoded equivalents in these parameters.

Network detection commands could include using tools like curl or wget to test the endpoint for path traversal attempts, or using web server logs to grep for suspicious parameter values.

• Example command to search web server logs for path traversal attempts: grep -E 'chatId=.*\.\./|chatflowId=.*\.\./' /var/log/nginx/access.log
• Use curl to test the upload endpoint with path traversal payloads: curl -X POST 'http://<target>/api/v1/attachments?storageType=local&chatId=../../etc/passwd&chatflowId=1' -F 'file=@maliciousfile'

Additionally, monitoring for unexpected file creations or modifications in directories where uploads should not occur can help detect exploitation attempts.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting or disabling the /api/v1/attachments endpoint if not required, especially when storageType is set to local.

Apply strict validation and sanitization on the chatId and chatflowId parameters to prevent path traversal attacks.

Implement authentication and authorization checks on the /api/v1/attachments endpoint to prevent unauthenticated access.

Restrict file types and enforce safe file upload handling to avoid uploading executable or malicious files.

Update Flowise to a version later than 2.2.4 where this vulnerability is patched, if such a version is available.

Monitor your systems for signs of compromise and review uploaded files for unauthorized content.

Useful 0 Not Useful 0