CVE-2024-36421: GHSL-2023-232_GHSL-2023-234: Path injection, Cross-Site Scripting (XSS) and CORS misconfiguration in Flowise - CVE-2024-36420, CVE-2024-36421, CVE-2024-36422, CVE-2024-36423, CVE-2024-37145, CVE-2024-37146
Flowise is a drag & drop user interface to build a customized large language model flow. In version 1.4.3 of Flowise, A CORS misconfiguration sets the Access-Control-Allow-Origin header to all, allowing arbitrary origins to connect to the website. In the default configuration (unauthenticated), arbitrary origins may be able to make requests to Flowise, stealing information from the user. This CORS misconfiguration may be chained with the path injection to allow an attacker attackers without access to Flowise to read arbitrary files from the Flowise server. As of time of publication, no known patches are available.
Other sources
Flowise is vulnerable to path injection, cross site scripting and CORS misconfiguration vulnerabilities, that may compromise the confidentiality of the information on the host server. In the worst case, it may allow attackers to read files from the Flowise server and read/modify user secrets.
— GitHub Security Lab
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-36421?
CVE-2024-36421 has a moderate severity rating due to the CORS misconfiguration that could allow unauthorized access.
How do I fix CVE-2024-36421?
To fix CVE-2024-36421, you should configure the Access-Control-Allow-Origin header to only allow trusted origins.
Who is affected by CVE-2024-36421?
CVE-2024-36421 affects users of Flowise version 1.4.3 and earlier.
What causes CVE-2024-36421?
CVE-2024-36421 is caused by a CORS misconfiguration that sets the Access-Control-Allow-Origin header to allow any origin.
What is the potential impact of CVE-2024-36421?
The potential impact of CVE-2024-36421 includes unauthorized access to sensitive data and resources via cross-origin requests.