Flowise Discloses Reflected Cross-Site Scripting Vulnerability

CVE-2024-37145

What is CVE-2024-37145?

In Flowise version 1.4.3, a vulnerability exists in the '/api/v1/chatflows-streaming/id' endpoint that can lead to reflected cross-site scripting (XSS) attacks. This vulnerability is present when default configurations are maintained, permitting unauthenticated access. An attacker can formulate a specially crafted URL to inject malicious JavaScript into user sessions, which might result in the theft of sensitive information, the creation of misleading popups, or redirects to other malicious sites without any user interaction. Noticeably, if the specified chatflow ID is invalid, it gets reflected on the 404 error page, which is served with an HTML content type. This allows an attacker to attach arbitrary scripts to the response, further facilitating the stealing of sensitive data. Additionally, this XSS vulnerability can be combined with path injection techniques, granting attackers the ability to access arbitrary files on the Flowise server without any direct access. Currently, there are no available patches for this issue.

References