Server-Side Request Forgery (SSRF) in Flowise - #VU146552

Vulnerability details

The vulnerability allows a remote user to perform server-side requests and disclose sensitive information, including LLM provider API keys.

The vulnerability exists due to server-side request forgery (SSRF) in chat-model nodes when processing user-controlled basepath or baseUrl values as the provider SDK baseURL. A remote user can create or update a chatflow with an attacker-controlled URL and trigger a prediction to perform server-side requests and disclose sensitive information, including LLM provider API keys.

The issue affects ChatOpenAICustom, both ChatOllama variants, ChatLocalAI, ChatLitellm, ChatNvdiaNIM, ChatNemoGuardrails, ChatCloudflareWorkersAI, and ChatGoogleGenerativeAI. The response from the outbound request can be returned through chat output, and the provider API key may be sent in the Authorization header. Publicly exposed prediction endpoints can broaden reach if a malicious chatflow is published.

Affected software

Remediation

External References

• https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-hx55-h48h-7rw9

Related Security Bulletins

• Multiple vulnerabilities in Flowise