Flowise 1.4.3 - Arbitrary File Read

Flowise 1.4.3 contains a path traversal caused by lack of sanitization of 'fileName' parameter in /api/v1/openai-assistants-file endpoint in index.ts, letting attackers read arbitrary files, exploit requires attacker to send crafted request. id: CVE-2024-36420 info: name: Flowise 1.4.3 - Arbitrar...

POC_CVE-2024-36420

POCCVE-2024-36420 针对 Flowise 的 CVE-2024-36420 本地复现实验室与 nuclei 模板草稿。 摘要 CVE-2024-36420 是 Flowise 中因未对 fileName 请求体参数进行清理而导致的任意文件读取漏洞，漏洞位于： POST /api/v1/openai-assistants-file 该实验室用于验证： flowiseai/flowise:1.4.3 版本的脆弱行为 较新版本 flowiseai/flowise:3.1.2 的拒绝行为 参考...

Exploit for Injection in Flowiseai Flowise

POCCVE-2024-36420 Local reproduction lab and nuclei template...