Critical Flowise Flaw Allows Unauthenticated Remote Access

Key Findings:

• Flowise, a popular open-source low-code workflow platform, contains a critical vulnerability allowing unauthenticated remote admin takeover.

• The vulnerability is due to an exposed registration endpoint that can be exploited to gain full administrative control of the Flowise instance.

• No authentication is required to leverage this flaw, making it trivial for attackers to gain complete control of affected systems.

• The vulnerability has been assigned the CVE identifier CVE-2023-XXXXX and has a CVSS score of 9.8, indicating it is an extremely high-risk issue.

Background

Flowise is an open-source low-code workflow platform that allows users to build and deploy complex workflows without extensive programming knowledge. It is widely used by developers, DevOps engineers, and IT professionals to automate various business processes. The platform is built using Node.js and has a modular architecture, making it highly extensible and customizable.

Vulnerability Details

The critical vulnerability in Flowise is caused by an exposed registration endpoint that can be exploited to create a new administrative user account without any authentication. By sending a crafted HTTP request to the registration endpoint, an attacker can register a new user with full administrative privileges, granting them complete control over the Flowise instance.

Once an attacker has gained administrative access, they can perform a wide range of malicious actions, including:

• Accessing and modifying sensitive data stored within the Flowise instance

• Deploying malicious workflows or modules that could compromise the integrity of the system

• Launching further attacks on the underlying infrastructure or connected systems

Impact and Exploitation

The impact of this vulnerability is severe, as it allows unauthenticated remote attackers to completely compromise affected Flowise instances. The ease of exploitation and the level of access gained by the attacker make this a critical security issue that requires immediate attention.

Exploitation of this vulnerability can be automated, with publicly available tools and scripts, making it accessible to a wide range of attackers, from individual cybercriminals to advanced persistent threat (APT) groups.

Mitigations and Recommendations

Flowise users are strongly advised to update their Flowise instances to the latest available version as soon as possible to mitigate this vulnerability. Additionally, it is recommended to review and restrict access to the registration endpoint, potentially by implementing IP-based access controls or other security measures.

In the meantime, users should closely monitor their Flowise instances for any suspicious activity and report any incidents to the Flowise security team and the appropriate authorities.

Sources

• https://securityonline.info/critical-flowise-flaw-allows-unauthenticated-remote-admin-takeover-via-exposed-registration-endpoint/

• https://x.com/fridaysecurity/status/1990735134429982883