Flowise Unsafe Serialization in MCP Adapter Allows Command Execution
Overview
Flowise, a drag-and-drop interface for building LLM flows, has a critical vulnerability in versions prior to 3.1.0. The vulnerability exists within the Message Communication Protocol (MCP) adapter's handling of standard input/output (stdio) commands. Specifically, the "Custom MCP" configuration on the canvas interface (accessible via http://localhost:3000/canvas) fails to adequately sanitize user-provided commands. An authenticated attacker can leverage this by adding a new MCP stdio server and injecting arbitrary commands. Despite existing input sanitization functions like `validateCommandInjection` and `validateArgsForLocalFileAccess`, and a predefined list of safe commands, the mechanism allows for the concatenation of safe commands like 'npx' with malicious execution arguments (e.g., '-c touch /tmp/pwn'). This allows an attacker to execute arbitrary code on the underlying operating system where Flowise is running. This RCE (Remote Code Execution) poses a significant security risk, allowing for potential data compromise, system takeover, and further exploitation.
Affected Systems
Testing Guide
1. Access the Flowise canvas (e.g., http://localhost:3000/canvas). 2. Log in with authenticated user credentials. 3. Attempt to add a new MCP configuration. 4. In the "Custom MCP" settings, configure a new MCP using stdio. 5. Inject a command string that attempts to execute arbitrary OS commands. For example, try adding a command like `npx -c 'echo vulnerable > /tmp/test_rce'` or similar harmless but verifiable OS commands. 6. Observe if the command is executed by checking for the expected side effect (e.g., creation of the `/tmp/test_rce` file).
Mitigation Steps
- Upgrade Flowise to version 3.1.0 or later. - If upgrading is not immediately possible, restrict access to the Flowise instance to only trusted authenticated users. - Implement network-level access controls to limit who can connect to the Flowise instance. - Regularly monitor Flowise logs for unusual command execution patterns within the MCP adapter.
Patch Details
Version 3.1.0