Flowise und Flowise Chat Embed anfällig für Stored Cross-Site Scripting

The XSS vulnerability in Flowise Embed allows an attacker to inject arbitrary JavaScript code into the application. This code can then be executed in the context of a victim's browser when they interact with a vulnerable Flowise application. An attacker could leverage this to steal sensitive information like session cookies, user credentials, or even redirect users to malicious websites. The impact is particularly severe because the vulnerability is 'stored,' meaning the malicious script persists on the server and can affect multiple users over time. This contrasts with reflected XSS, which requires an attacker to trick a user into clicking a malicious link. The potential for widespread impact and data compromise makes this a high-priority vulnerability.

Websites and applications that integrate Flowise Chat Embed versions prior to 2.0.0 are at risk. This includes developers who have directly included the package in their projects, as well as users of platforms or services that utilize Flowise Chat Embed without proper security controls. Shared hosting environments where multiple websites share the same server infrastructure are particularly vulnerable, as a compromise of one website could potentially affect others.

• nodejs / supply-chain:

  npm list flowise-embed

If the version is less than 2.1.1, the system is vulnerable. • generic web: Inspect the Flowise Chat Embed integration for any unusual JavaScript behavior or unexpected redirects. Examine the source code for any user-controlled input that is not properly sanitized before being rendered. • generic web: Review access logs for suspicious requests containing JavaScript payloads targeting the chat embed functionality.

1. 2024-09-25Disclosure

   disclosure

1. Reserviert2024-09-24
2. Veröffentlicht2024-09-25
3. Geändert2024-09-30
4. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2024-9148 is to immediately upgrade Flowise Embed to version 2.0.0 or later, which contains the necessary input sanitization fixes. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) rule to filter potentially malicious input based on common XSS patterns. Carefully review and sanitize all user-supplied input before rendering it in the application. Regularly scan your Flowise deployments for vulnerabilities using automated security tools. After upgrading, confirm the fix by attempting to inject a simple JavaScript payload (e.g., <script>alert('XSS')</script>) into a Flowise Chat Embed field and verifying that it is properly sanitized and does not execute.