Hardcoded Secret in Flowise Authentication Bypass

Executive Summary

Flowise versions before 3.1.0 (specifically 3.0.13 and earlier) use a weak hardcoded default secret ('flowise') for the express-session middleware if the EXPRESS_SESSION_SECRET environment variable is not set.

Because this default secret is publicly visible in the source code, an attacker can exploit it by forging valid signed session cookies.

This allows the attacker to impersonate any user and bypass authentication mechanisms.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if the Flowise application version is 3.0.13 or earlier and if the EXPRESS_SESSION_SECRET environment variable is not set, causing the application to use the weak default secret 'flowise'.

To detect this on your system, you can:

• Verify the Flowise version installed (should be 3.0.13 or earlier to be vulnerable).
• Check if the environment variable EXPRESS_SESSION_SECRET is set.
• Search the source code or running environment for the default secret 'flowise'.

Example commands to assist detection:

• Check Flowise version: `flowise --version` or inspect package.json if applicable.
• Check environment variable: `echo $EXPRESS_SESSION_SECRET` (Linux/macOS) or `echo %EXPRESS_SESSION_SECRET%` (Windows).
• Search for the default secret in source files: `grep -r "flowise" ./packages/server/src/enterprise/middleware/passport/`

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts as it allows attackers to bypass authentication and impersonate any user.

An attacker gaining unauthorized access could lead to data breaches, unauthorized actions within the application, and compromise of user accounts.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows attackers to forge session cookies and impersonate users, leading to unauthorized access and potential exposure of sensitive personal data.

Such unauthorized access and data exposure can result in non-compliance with data protection regulations like GDPR and HIPAA, which require strict controls on user authentication and protection of personal information.

Failure to secure session management mechanisms as in this case could lead to breaches of confidentiality and integrity, increasing the risk of regulatory penalties and loss of trust.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should ensure that the EXPRESS_SESSION_SECRET environment variable is set to a strong, unique secret value instead of relying on the weak hardcoded default ('flowise').

Updating Flowise to a version later than 3.1.0, where this issue is fixed, is also recommended.

Useful 0 Not Useful 0