CVE-2024-36421— GHSL-2023-234: Flowise Cors Misconfiguration in packages/server/src/index.ts

GHSL-2023-234: Flowise Cors Misconfiguration in packages/server/src/index.ts

Flowise is a drag & drop user interface to build a customized large language model flow. In version 1.4.3 of Flowise, A CORS misconfiguration sets the Access-Control-Allow-Origin header to all, allowing arbitrary origins to connect to the website. In the default configuration (unauthenticated), arbitrary origins may be able to make requests to Flowise, stealing information from the user. This CORS misconfiguration may be chained with the path injection to allow an attacker attackers without access to Flowise to read arbitrary files from the Flowise server. As of time of publication, no known patches are available.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

源验证错误

Flowise 安全漏洞

Flowise是一个用于轻松构建 LLM 应用程序的工具。 Flowise 1.4.3 版本存在安全漏洞，该漏洞源于跨域资源共享配置错误得将 Access-Control-Allow-Origin 标头设置为全部，允许任意来源连接到网站。在默认配置（未经身份验证）下，任意来源可能能够向 Flowise 发出请求，窃取用户信息。此 CORS 配置错误可能与路径注入相结合，允许攻击者（无需访问 Flowise）从 Flowise 服务器读取任意文件。

N/A

N/A