Flowise TTS Endpoint CORS Misconfiguration Allows Credential Abuse

Executive Summary

This vulnerability exists in Flowise versions before 3.1.2, where the text-to-speech (TTS) generation endpoint sets the Access-Control-Allow-Origin header to a hardcoded wildcard (*).

This setting ignores the server's configured CORS policy, which is normally restrictive, and allows any webpage to make cross-origin requests to the TTS endpoint.

As a result, an attacker can cause a user's browser to send requests to the TTS endpoint using the user's stored credentials, enabling drive-by cross-origin credential abuse.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, you can check if the Flowise TTS generation endpoint is returning the HTTP header Access-Control-Allow-Origin with a wildcard (*) value, which indicates the hardcoded CORS policy bypass.

One way to test this is by sending an HTTP request to the TTS endpoint and inspecting the response headers.

• Use curl to check the Access-Control-Allow-Origin header: curl -I https://your-flowise-server/path-to-tts-endpoint
• Look for the header line: Access-Control-Allow-Origin: *

If the header is present with a wildcard, the system is vulnerable.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized use of a user's credentials through cross-origin requests, allowing attackers to trigger TTS generation without the user's consent.

Such drive-by credential abuse can result in misuse of the service, potential data exposure, or other unauthorized actions performed on behalf of the user.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows any webpage to make cross-origin requests that trigger text-to-speech generation using stored credentials due to a hardcoded wildcard in the Access-Control-Allow-Origin header. This can lead to unauthorized use of credentials and potential data exposure.

Such unauthorized cross-origin credential abuse could impact compliance with standards and regulations like GDPR and HIPAA, which require strict controls on data access and protection of personal and sensitive information.

By bypassing the server's restrictive CORS policy, this vulnerability may increase the risk of data breaches or unauthorized data processing, potentially violating requirements for data confidentiality and integrity under these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate and recommended mitigation is to upgrade Flowise to version 3.1.2 or later, where the hardcoded Access-Control-Allow-Origin wildcard has been removed.

This update ensures that the server's configured CORS policy is properly enforced, preventing unauthorized cross-origin requests to the TTS endpoint.

Until the upgrade can be applied, consider restricting access to the TTS endpoint through network controls or firewall rules to limit exposure.

Useful 0 Not Useful 0