Remote Code Execution in Flowise AI Platform

Executive Summary

This vulnerability in Flowise 3.1.2 allows a remote attacker to execute arbitrary code through the /api/v1/prediction/<flowId> endpoint. The issue likely stems from insufficient input validation or authentication checks on this endpoint, enabling attackers to inject malicious commands or payloads.

Useful 0 Not Useful 0

Detection Guidance

Check Flowise server logs for suspicious requests to /api/v1/prediction/<flowId> endpoints with unusual parameters or payloads. Monitor network traffic for unauthorized outbound connections from the Flowise process.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability could allow attackers to run arbitrary code on the affected system. This may lead to unauthorized access, data theft, system compromise, or further lateral movement within a network. Users running Flowise 3.1.2 should update immediately.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection requirements or HIPAA's safeguards for protected health information. Organizations may face compliance breaches, legal penalties, and reputational damage if exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Flowise to the latest patched version immediately. If upgrading is not possible, restrict access to the /api/v1/prediction/<flowId> endpoint via firewall rules or disable it if unused. Review and rotate all API keys associated with Flowise.

Useful 0 Not Useful 0