Executive brief
Flowise, an open-source tool for building LLM applications, is vulnerable to a security flaw in its data import functions. An authorized user can upload a specially crafted file that allows them to run unauthorized database commands. This could lead to the theft of sensitive information, such as API keys and credentials, or allow an attacker to move deeper into the organization's network.
Technical details
A SQL injection vulnerability exists in Flowise versions up to 2.2.7 within the importChatflows, importTools, and importVariables functions. The root cause is the lack of sanitization and the use of template literals to construct SQL 'IN' clauses using the 'id' field from user-provided JSON files. An authenticated attacker can exploit this by uploading a malicious JSON file containing SQL payloads in the 'id' field. Successful exploitation allows for blind SQL injection, which can be used to extract sensitive data from the 'credential' table, including encrypted API keys and names. Additionally, improper validation of the 'id' field can lead to path traversal-like behavior in the application UI.
Affected products
- FlowiseAI flowise <= 2.2.7
Timeline
- 2025-04-07: disclosed
- 2025-04-07: advisory