Flowise CVE-2024-7041: RBAC Bypass via Svars Injection Leading to Unauthorized Workspace Variables Disclosure

Vulnerability Overview Vulnerability Name: RBAC Bypass Leading to Unauthorized Workspace Variables Disclosure Vulnerability Description: This vulnerability allows for the bypass of permission checks via injection, resulting in the unauthorized disclosure of workspace variables, including sensitive information such as database passwords and JWT keys. Affected Versions Affected Versions: <= 3.1.2 Fixed Version: 3.1.3 Remediation 1. Minimal Fix: - Inject only when the caller is authorized. - Enforce the permission before injecting . - Inject only the explicit whitelist of variables required by the function. - Consider disabling or strictly restricting variables in self-hosted environments (or limit which environment variables can be mapped). Code Locations Variable Retrieval: Runtime Variable Resolution: Svars Injection: Official Variables API: Exploitation User API Key: Even if denied permission, a user API key can retrieve all workspace variables, including runtime values from , via the route. Exposed Data Static Variables: Runtime Variables: (when ) Additional Information Severity: High (CVSS v4 base metrics: 7.1 / 10) CVSS Vector: CVE ID: CVE-2024-7041 Reporter: EaAa001 Summary This vulnerability allows unauthorized users to obtain sensitive variables within the workspace, such as database passwords and JWT keys, via injection. The remediation involves restricting the conditions for injection and strengthening permission checks.

Goal Reached Thanks to every supporter — we hit 100%!

Flowise CVE-2024-7041: RBAC Bypass via Svars Injection Leading to Unauthorized Workspace Variables Disclosure

More from this source