CVE-2024-36421: Flowise CORS misconfiguration vulnerability

# CVE-2024-36421: Flowise CORS misconfiguration vulnerability

https://gcdradar.vercel.app/incidents/cve-2024-36421-flowise-cors-misconfiguration-vulnerability · AIR-2024-0154 · closed 2024-07-01

- Lane: Patch now
- Severity: 2 (Disclosed vulnerability)
- Fix status: Fix status unknown
- First reported: 2024-07-01 (happened 2024-08-05)
- AI role: Attack on AI
- Products: Flowise
- CVE ids: CVE-2024-36421
- CVSS: 8.7

## Summary

Flowise version 1.4.3 contains a CORS misconfiguration that allows arbitrary origins to connect and make requests to the application. This can lead to information theft and can be chained with path injection to read server files.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2024-08-05: CVE-2024-36421: Flowise Cors Misconfiguration in packages/server/src/index.ts (https://github.com/advisories/GHSA-66f2-xxgm-f6xp)
- 2024-07-01: CVE-2024-36421: Flowise is a drag & drop user interface to build a customized large language model flow. (https://nvd.nist.gov/vuln/detail/CVE-2024-36421)

## Sources

- 2024-07-01 NVD: CVE-2024-36421: Flowise is a drag & drop user interface to build a customized large language model flow. https://nvd.nist.gov/vuln/detail/CVE-2024-36421
- 2024-08-05 GitHub Advisory Database: CVE-2024-36421: Flowise Cors Misconfiguration in packages/server/src/index.ts https://github.com/advisories/GHSA-66f2-xxgm-f6xp

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.