Flowise CSVAgent Command Injection Vulnerability
Overview
Flowise, a platform for building custom LLM flows, has a critical command injection vulnerability in its CSVAgent component. Versions prior to 3.1.0 allow users to provide custom Python code for reading CSV files. This feature, intended for flexibility, fails to properly sanitize user-supplied code. An attacker can craft a malicious CSV reading script containing arbitrary operating system commands. When this script is processed by the CSVAgent, the unescaped commands are injected directly into the server's execution environment and run with the privileges of the Flowise application. This can lead to complete system compromise, allowing attackers to steal data, install malware, or disrupt services. The vulnerability stems from insufficient input validation and sanitization of the code executed by the `pandas.read_csv` functionality when a custom reader is specified.
Affected Systems
Testing Guide
* **Prerequisites:** Access to a Flowise instance running a vulnerable version (prior to 3.1.0) and the ability to create and configure a new LLM flow. * **Steps:** 1. Create a new LLM flow in Flowise. 2. Add a "CSV Agent" node to the flow. 3. In the CSVAgent configuration, locate the option to provide custom Pandas CSV read code. 4. Enter a simple command injection payload into the custom code field. For example, try to execute `os.system('echo vulnerable')` or `os.system('id')`. 5. Save and attempt to run the flow. * **Expected Outcome:** If vulnerable, the injected command will be executed on the server, potentially resulting in errors or observable output depending on the command used and server configuration. For instance, if you use `os.system('id')`, the output of the `id` command might appear in the Flowise logs or error messages.
Mitigation Steps
* Upgrade Flowise to version 3.1.0 or later. * Restrict access to the Flowise instance, especially for untrusted users. * Implement network-level filtering to block known malicious command injection patterns. * Regularly audit server logs for suspicious command execution attempts. * If upgrading is not immediately possible, disable the CSVAgent functionality or strictly limit its usage to trusted data sources.
Patch Details
Version 3.1.0