Horizon Alert
Summary of the vulnerability and why it matters
The Flowise application has a critical vulnerability where user input is not properly sanitized when building custom large language model flows. This allows an attacker to inject malicious commands that can be executed on the connected Neo4j database. This is a serious concern as it can lead to unauthorized access and manipulation of sensitive data.
- Data can be stolen or altered.
- Anyone can potentially exploit this.
- Requires use of the affected application.
Attack Path
How an attacker could exploit the issue
An attacker can exploit this by sending crafted input to a Flowise instance prior to version 3.1.0. This input will be directly embedded into a Cypher query executed against an underlying Neo4j database, allowing the attacker to read, modify, or delete sensitive data.
- No authentication required.
- Target is user input to GraphCypherQAChain.
- Exploitation requires a vulnerable Flowise instance.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability allows unauthenticated attackers to inject malicious Cypher commands directly into a Neo4j database through the GraphCypherQAChain node in Flowise versions prior to 3.1.0. Exploitation could lead to sensitive data being exfiltrated, modified, or deleted, representing a significant risk to data integrity and confidentiality. Attackers would find this appealing due to the direct database access it offers without authentication.
- No known exploitation in the wild.
- Public exploit code is not yet available.
- Vulnerability affects a web-facing application.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
Prioritize patching all Flowise instances to version 3.1.0 or later immediately, as unpatched versions are critically vulnerable to Cypher injection attacks. If immediate patching is not feasible, isolate affected services from the network to prevent exploitation and subsequent data compromise.
- Update Flowise to version 3.1.0 or newer.
- Block network access to vulnerable instances.
- Monitor for unauthorized Cypher query executions.
