Flowise CSV Agent LLM Script Injection Vulnerability
Overview
Flowise, a low-code UI for building LLM workflows, suffers from a critical vulnerability in versions prior to 3.1.0. The flaw resides in the `run` method of the `CSV_Agents` class. This method fails to adequately sandbox the execution of Python scripts generated by a Large Language Model (LLM). An unauthenticated attacker can exploit this by using prompt injection techniques. By crafting a malicious prompt, the attacker can trick the LLM into generating a Python script. When this script is executed by the CSV Agent node within a chatflow, it allows for arbitrary command execution on the Flowise server, operating with the privileges of the user running the Flowise instance. This could lead to complete system compromise.
Affected Systems
Testing Guide
1. Deploy a Flowise instance with a version prior to 3.1.0. 2. Create a chatflow utilizing the CSV Agent node. 3. Construct a series of prompts designed to elicit Python script generation from the LLM, specifically aiming to inject commands like `os.system('whoami')` or `print(os.environ)`. 4. Observe the Flowise server logs or the output of the chatflow to determine if the injected commands are executed.
Mitigation Steps
1. Upgrade Flowise to version 3.1.0 or later. 2. Implement strict input validation and sanitization on all user-provided prompts, especially those sent to LLM-powered agents. 3. Isolate the Flowise server environment using network segmentation and principle of least privilege. 4. Regularly audit Flowise server logs for suspicious command execution patterns. 5. Consider disabling or strictly controlling the use of the CSV Agent node if upgrading is not immediately possible.
Patch Details
3.1.0