Executive brief
Flowise is a visual interface for building customized AI workflows. The /api/v1/credentials/id endpoint contains a reflected cross-site scripting (XSS) vulnerability that allows an attacker to inject malicious JavaScript into a user's session by crafting a specially crafted URL. An attacker could exploit this to steal sensitive information, create fake popups, redirect users to malicious sites, or chain it with other vulnerabilities to read arbitrary files from the server.
Technical details
A reflected cross-site scripting (CWE-79) vulnerability exists in the /api/v1/credentials/id endpoint in Flowise version 1.4.3 and earlier. When a credential ID is not found, its value is reflected in the 404 error page with a text/html content type, allowing injection of arbitrary JavaScript. The vulnerability requires user interaction (clicking a malicious link) but requires no authentication if default configuration is used, and is reachable over the network. An attacker can craft URLs to steal session data, perform actions on behalf of the user, or chain this with path injection vulnerabilities to read arbitrary files from the Flowise server. As of the advisory publication date, no patch was available.
Affected products
- FlowiseAI Flowise up to 1.4.3
Timeline
- 2024-08-05: disclosed
- 2024-07-01: other: CVE published