Flowise 和 Flowise Chat Embed 存在存储型跨站脚本 (Stored Cross-Site Scripting) 漏洞

此 XSS 漏洞允许攻击者在受影响的 flowise-embed 应用中注入恶意 JavaScript 代码。攻击者可以利用此漏洞窃取用户会话 cookie、重定向用户到恶意网站或执行其他恶意操作。由于漏洞是存储型的，这意味着恶意脚本将持久存在于数据库中，并影响所有访问受感染页面的用户。攻击者可能利用此漏洞进行钓鱼攻击，窃取敏感信息，或完全控制受影响的应用程序。

Websites and applications that integrate Flowise Chat Embed versions prior to 2.0.0 are at risk. This includes developers who have directly included the package in their projects, as well as users of platforms or services that utilize Flowise Chat Embed without proper security controls. Shared hosting environments where multiple websites share the same server infrastructure are particularly vulnerable, as a compromise of one website could potentially affect others.

• nodejs / supply-chain:

  npm list flowise-embed

If the version is less than 2.1.1, the system is vulnerable. • generic web: Inspect the Flowise Chat Embed integration for any unusual JavaScript behavior or unexpected redirects. Examine the source code for any user-controlled input that is not properly sanitized before being rendered. • generic web: Review access logs for suspicious requests containing JavaScript payloads targeting the chat embed functionality.

1. 2024-09-25Disclosure

   disclosure

1. 已保留2024-09-24
2. 发布日期2024-09-25
3. 修改日期2024-09-30
4. EPSS 更新日期2026-04-02

最有效的缓解措施是立即将 flowise-embed 升级至 2.0.0 或更高版本。如果无法立即升级，可以考虑实施输入验证和输出编码措施，以防止恶意脚本注入。此外，可以配置 Web 应用防火墙 (WAF) 以检测和阻止 XSS 攻击。监控应用程序日志，查找可疑的 JavaScript 注入尝试，并定期扫描应用程序以查找潜在的漏洞。