Remote Code Execution in Flowise via Unsanitized Pandas Input
Overview
A critical remote code execution (RCE) vulnerability has been identified in Flowise, an open-source tool for building custom large language model (LLM) flows. The vulnerability, present in versions prior to 3.1.0, resides within the AirtableAgent.ts file. It stems from insufficient input validation when the agent interacts with Pandas. Specifically, user-provided input is directly incorporated into the 'question' parameter of a prompt template. This unsanitized input is then passed to underlying Python code, allowing an attacker to inject arbitrary Python commands. By crafting malicious input, an attacker could potentially execute arbitrary code on the server hosting Flowise, leading to a complete compromise of the system. The vulnerability is exacerbated by the direct reflection of user input into executable Python code without any sanitization or escaping mechanisms, making it a prime target for code injection attacks.
Affected Systems
Testing Guide
1. Ensure you have a Flowise instance running a version prior to 3.1.0. 2. Create a new LLM flow that utilizes the AirtableAgent. 3. In the configuration for the AirtableAgent, specifically within the 'question' parameter or any user-inputtable field that interacts with Pandas, inject Python code (e.g., `import os; os.system('echo vulnerable')`). 4. Observe the behavior of the Flowise instance and the underlying server. If the injected command executes (e.g., 'vulnerable' appears in logs or system output), the system is affected.
Mitigation Steps
- Upgrade Flowise to version 3.1.0 or later. - Implement strict input validation and sanitization for all user-provided data used in LLM prompts and agent interactions. - Isolate Flowise instances and limit network access to only trusted sources. - Regularly review and audit Flowise agent configurations and prompt templates for potential injection points.
Patch Details
Flowise 3.1.0