XSS in Flowiseai Flowise
CVE-2024-36422
Flowise is a drag & drop user interface to build a customized large language model flow. In version 1.4.3 of Flowise, a reflected cross-site scripting vulnerability occurs in the `api/v1/chatflows/id` endpoint. If the default configuration is used (unauthenticated), an attacker may be able to craft a specially crafted URL that injects Javascript into the user sessions, allowing the attacker to steal information, create false popups, or even redirect the user to other websites without interaction. If the chatflow ID is not found, its value is reflected in the 404 page, which has type text/html. This allows an attacker to attach arbitrary scripts to the page, allowing an attacker to steal sensitive information. This XSS may be chained with the path injection to allow an attacker without direct access to Flowise to read arbitrary files from the Flowise server. As of time of publication, no known patches are available.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.004 (34.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.
Affected products
- Flowiseai Flowise — versions 1.4.3, <= 1.4.3
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security-advisories@github.com (x_refsource_CONFIRM, Exploit, Third Party Advisory)
- security-advisories@github.com (Product, x_refsource_MISC)
Frequently asked questions
- What is CVE-2024-36422?
- CVE-2024-36422 is a medium-severity vulnerability in Flowiseai Flowise, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2024-07-01.
- How severe is CVE-2024-36422?
- Medium severity. CVSS v3 base score is 6.1 out of 10.
- Is CVE-2024-36422 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.