Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe analysis of the vulnerability indicates a classic Server-Side Request Forgery (SSRF) in the /api/v1/fetch-links endpoint. The vulnerability is triggered when a user supplies a malicious URL that the Flowise server then fetches.
The investigation started by examining the provided vulnerability description, which pointed out the vulnerable endpoint and the parameters (url, relativeLinksMethod) an attacker would use. The description also provided links to the vulnerable code sections at a specific commit (5930f1119c655bcf8d2200ae827a1f5b9fec81d0).
The patch was identified by comparing the commits between the last vulnerable version (3.0.5) and the first patched version (3.0.6). The commit e002e617df6177cb603c8c569d224bce5fb96b33 with the message "Bugfix/Securely Fetch Links (#5200)" was clearly the fix.
The vulnerable functions were identified by tracing the data flow from the controller to the function making the HTTP request:
getAllLinks (controller): Receives the request.getAllLinks (service): Routes the request to the appropriate scraper.xmlScrape and webCrawl (utils): These functions perform the actual HTTP fetch operation using the user-provided URL without proper validation.The patch introduced new functions, secureFetch and checkDenyList, to validate the URL before making the request. The vulnerable functions are the ones that existed before this patch and made the insecure calls. Therefore, xmlScrape and webCrawl are the core vulnerable functions where the SSRF occurs, and the getAllLinks functions are the entry points that facilitate the attack.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| flowise | npm | = 3.0.5 | 3.0.6 |