FlowiseAI API Chain SSRF Vulnerability

FlowiseAI, a low-code open-source platform for building custom LLM flows, is vulnerable to Server-Side Request Forgery (SSRF) in its POST/GET API Chain components. This vulnerability, affecting versions 3.0.13 and earlier, allows unauthenticated attackers to inject malicious prompt templates into the API documentation, causing the FlowiseAI server to make arbitrary HTTP requests to internal and external systems. The root cause is the lack of validation when constructing URLs and request parameters from LLM responses. Attackers can exploit this by providing fake API documentation that redirects requests to sensitive internal services, enabling internal network reconnaissance, credential access, and data exfiltration. This vulnerability poses a significant risk as it allows attackers to bypass intended API constraints and potentially gain unauthorized access to internal resources.

Attack Chain

1. The attacker crafts a malicious prompt containing a manipulated API documentation section.
2. This malicious prompt is injected into the FlowiseAI API Chain component via user-controlled input.
3. The API Chain component uses an LLM to generate a URL and data parameters based on the injected API documentation.
4. Due to lack of validation, the system constructs an HTTP request using the attacker-controlled URL and data.
5. The FlowiseAI server executes the HTTP request to the attacker-specified internal or external endpoint using the fetch function in postCore.ts.
6. The attacker gains the ability to interact with internal APIs, cloud metadata endpoints, or other sensitive resources that trust the FlowiseAI server.
7. The attacker scans internal network services to identify running applications and open ports.
8. The attacker exfiltrates sensitive data obtained from internal services or cloud metadata.

Impact

The SSRF vulnerability allows unauthenticated attackers to abuse the FlowiseAI server as a proxy, leading to internal network reconnaissance, access to cloud metadata, exploitation of internal services, and potential data exfiltration. A successful attack can compromise sensitive internal data, bypass firewall rules, and allow attackers to pivot to other internal resources. Affected packages include npm/flowise and npm/flowise-components with versions 3.0.13 and earlier. This vulnerability enables attackers to scan internal network services and potentially access cloud metadata endpoints to retrieve credentials.

Recommendation

• Apply patches or upgrade to versions later than 3.0.13 for npm/flowise and npm/flowise-components to remediate the SSRF vulnerability.
• Deploy the Sigma rule "FlowiseAI Suspicious Internal Network Connection" to detect unauthorized connections to internal networks originating from FlowiseAI servers.
• Monitor network traffic originating from FlowiseAI servers for connections to internal IP ranges or sensitive internal services, based on the IOCs provided.
• Implement strict input validation and sanitization for user-provided API documentation to prevent prompt injection attacks.