FlowiseAI/Flowise hat eine Server-Side Request Forgery (SSRF) Vulnerabilität

The SSRF vulnerability in Flowise allows an attacker to craft malicious requests that are executed by the Flowise server. Because the server acts as a proxy, the attacker can bypass network restrictions and access internal web services that would normally be inaccessible from the outside. This could include sensitive administrative panels, internal APIs, or other resources that contain confidential data. The potential impact extends to information disclosure, unauthorized access to internal systems, and potentially even the execution of arbitrary code if vulnerable internal services are exposed. Exploitation could reveal internal network topology and expose vulnerabilities in other internal systems.

Organizations deploying Flowise in environments with internal web services or APIs are at risk. Shared hosting environments where Flowise instances share the same network infrastructure are particularly vulnerable, as an attacker could potentially pivot from a compromised Flowise instance to other internal services. Legacy Flowise configurations that haven't been regularly updated are also at increased risk.

• nodejs: Monitor process execution for unusual outbound network connections originating from the Flowise process. Use ps aux | grep flowise to identify the process and then netstat -anp | grep <flowise_pid> to check connections. • generic web: Examine access logs for requests to /api/v1/fetch-links with unusual or internal IP addresses in the URL. Use grep '/api/v1/fetch-links' access.log | grep <internal_ip>. • generic web: Check response headers for signs of internal resource exposure. Look for headers that reveal internal server information or redirect to internal services.

1. 2025-09-15Disclosure

   disclosure

1. Reserviert2025-09-17
2. Veröffentlicht2025-09-15
3. Geändert2025-09-22
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-59527 is to upgrade Flowise to version 3.0.6 or later, which contains the fix for the SSRF vulnerability. If upgrading is not immediately feasible, consider implementing temporary workarounds such as restricting outbound network access from the Flowise server to only necessary domains. Implement a Web Application Firewall (WAF) with rules to block requests to the /api/v1/fetch-links endpoint or filter requests based on URL patterns that could indicate SSRF exploitation. Monitor Flowise server logs for unusual outbound requests or connections to unexpected internal resources.