Flowise Pre-auth Arbitrary File Upload

@ /packages/server/src/routes/attachments/index.ts

const router = express.Router()
// CREATE
router.post('/:chatflowId/:chatId', getMulterStorage().array('files'), attachmentsController.createAttachment)
export default router

After several calls, the request reaches the createFileAttachment function @ (packages/server/src/utils/createAttachment.ts) Initially, the function retrieves chatflowid and chatId from the request without any additional validation. The only check performed is whether these parameters exist in the request.

    const chatflowid = req.params.chatflowId
    if (!chatflowid) {
        throw new Error(
            'Params chatflowId is required! Please provide chatflowId and chatId in the URL: /api/v1/attachments/:chatflowId/:chatId'
        )
    }

    const chatId = req.params.chatId
    if (!chatId) {
        throw new Error(
            'Params chatId is required! Please provide chatflowId and chatId in the URL: /api/v1/attachments/:chatflowId/:chatId'
        )
    }

Next, the function retrieves the uploaded files and attempts to add them to the storage by calling the addArrayFilesToStorage function.

const files = (req.files as Express.Multer.File[]) || []
    const fileAttachments = []
    if (files.length) {
        // ...
        for (const file of files) {
            const fileBuffer = await getFileFromUpload(file.path ?? file.key)  // get the uploaded file
            const fileNames: string[] = []
            file.originalname = Buffer.from(file.originalname, 'latin1').toString('utf8')
            // add it to the storage
            const storagePath = await addArrayFilesToStorage(file.mimetype, 
                                                             fileBuffer,
                                                             file.originalname,
                                                             fileNames,
                                                             chatflowid, chatId) // add it to the storage

            // ...

            await removeSpecificFileFromUpload(file.path ?? file.key) // delete from tmp
           //  ...

                fileAttachments.push({
                    name: file.originalname,
                    mimeType: file.mimetype,
                    size: file.size,
                    content
                })
            } catch (error) {
                throw new Error(`Failed operation: createFileAttachment - ${getErrorMessage(error)}`)
            }
        }
    }

    return fileAttachments

Now lets take a look at addArrayFilesToStorage function @ (/packages/components/src/storageUtils.ts)

export const addArrayFilesToStorage = async (mime: string, bf: Buffer, fileName: string, fileNames: string[], ...paths: string[]) => {
    const storageType = getStorageType()

    const sanitizedFilename = _sanitizeFilename(fileName)
    if (storageType === 's3') {
      // ...
    } else {
        const dir = path.join(getStoragePath(), ...paths) // PATH TRAVERSAL.
        if (!fs.existsSync(dir)) {
            fs.mkdirSync(dir, { recursive: true })
        }
        const filePath = path.join(dir, sanitizedFilename)
        fs.writeFileSync(filePath, bf)
        fileNames.push(sanitizedFilename)
        return 'FILE-STORAGE::' + JSON.stringify(fileNames)
    }
}

As noted in the comment, to construct the directory, the function joins the output of the getStoragePath function with ...paths, which are essentially the chatflowid and chatId extracted earlier from the request. However, as mentioned previously, these values are not validated to ensure they are UUIDs or numbers. As a result, an attacker could manipulate these variables to set the dir variable to any value. Combined with the fact that the filename is also provided by the user, this leads to unauthenticated arbitrary file upload.

POC

This is the a HTTP request. As observed, we are not authenticated, and by manipulating the chatId parameter, we can perform a path traversal. In this example, we overwrite the api.json file, which contains the API keys for the system.

in this example, the dir variable will be

var dir = '/root/.flowise/storage/test/../../../../../../../../root/.flowise/'

and the file name is api.json

And the API Keys in the UI

Impact

This vulnerability could potentially lead to

• Remote Code Execution
• Server Takeover
• Data Theft And more