Horizon Alert
Summary of the vulnerability and why it matters
This advisory concerns a critical vulnerability within the Flowise platform's JavaScript sandbox, specifically impacting the vm2 and nodevm components. An authenticated user with access to a particular API endpoint can exploit this to execute arbitrary operating system commands, potentially leading to unauthorized access and data exposure on the host system. The main concern is confirming relevance and exposure.
- Command execution in Flowise.
- Critical sandbox escape impacts host.
- Confirm relevance and exposure to systems.
Attack Path
How an attacker could exploit the issue
An attacker can begin by gaining authenticated access to the Flowise application. From there, they can interact with a specific API endpoint, which allows them to provide specially crafted parameters to a function that launches external processes. This manipulation allows them to break out of the intended sandbox environment, leading to the execution of arbitrary commands on the underlying operating system or the disclosure of sensitive files.
- Authenticated access to an API endpoint.
- Supply malicious parameters to a process launch function.
- Arbitrary code execution and file disclosure.
Live Threat
Current exploitation, exposure, and threat context
An authenticated user can execute arbitrary operating system commands and disclose host files. This occurs when the application's sandbox is bypassed, specifically through the `puppeteer.launch()` function with attacker-controlled `executablePath` and `args` parameters, which internally calls `child_process.spawn()`. The risk is heightened when `ALLOW_BUILTIN_DEP` is enabled.
- Arbitrary OS command execution.
- Exploitation via API endpoint.
- System compromise is possible.
Operational Fix
Recommended remediation, mitigation, and detection steps
The Flowise application, particularly its API endpoint for custom functions, presents a significant risk due to a sandbox escape vulnerability. Teams responsible for internal tooling, AI/ML platforms, or developer environments should prioritize assessing their exposure. The first step involves identifying all instances of Flowise, determining their network reachability and business criticality, and locating the accountable owner. This will inform a risk-based remediation plan, which may include vendor coordination for updates or implementing temporary mitigating controls.
- Platform or application owners should take ownership.
- Verify Flowise instances and network exposure.
- Plan remediation based on identified risk.
