Flowise CustomMCP Node Remote Code Execution

This repository is a small standalone Go proof-of-concept exploit for CVE-2025-59528 affecting Flowise <= 3.0.5. The repo contains only two files: a README describing the vulnerability and usage, and main.go implementing the exploit logic. The exploit is not part of a larger framework. The Go program accepts three arguments: a target base URL, an API key, and an arbitrary command to run. It validates that the supplied URL is only a base URL with http/https scheme and no extra path, then appends the vulnerable endpoint /api/v1/node-load-method/customMCP. It constructs a JSON body with loadMethod set to "listActions" and places a malicious JavaScript expression into inputs.mcpServerConfig. The injected JavaScript uses process.mainModule.require('child_process') and execSync() to run the attacker-provided command on the remote server. The exploit sends this payload as an authenticated POST request with Content-Type: application/json and Authorization: Bearer <api-key>. It then interprets HTTP responses such as 200, 401, 403, 404, and 500 to help the operator understand whether exploitation likely succeeded. Overall, this is a real operational RCE exploit rather than a detector. Its main capability is authenticated remote command execution against vulnerable Flowise instances through the CustomMCP node-loading API.

This repository is a small standalone Python proof-of-concept exploit for CVE-2025-59528 affecting Flowise. It contains one executable script, CVE-2025-59528.py, and a README with usage instructions and a reverse-shell example. The script accepts a target base URL, an attacker-supplied command string, and a valid API key or Bearer token. It then sends an authenticated POST request to the Flowise endpoint /api/v1/node-load-method/customMCP with JSON data containing a malicious JavaScript expression in inputs.mcpServerConfig. That expression uses process.mainModule.require('child_process') and cp.exec() to execute arbitrary operating system commands on the server. The exploit is clearly intended for authenticated RCE, not detection. It is operational rather than framework-based: the payload is customizable through the -cmd argument, but delivery logic is simple and single-purpose. The README demonstrates using the exploit to launch a netcat reverse shell via a named pipe under /tmp/f, indicating likely post-exploitation intent of obtaining an interactive shell on the Flowise host.

This repository is a small, focused exploit PoC for CVE-2025-59528 affecting Flowise versions earlier than 3.0.5. The repository contains two documentation files (README.md and README.fr.md) and one executable Python script (poc.py). The Python script is the sole exploit implementation and serves as the entry point. The exploit performs an authenticated HTTP POST request to the Flowise endpoint /api/v1/node-load-method/customMCP. It supplies a crafted JSON body where inputs.mcpServerConfig contains a malicious JavaScript expression. That expression invokes process.mainModule.require('child_process') and then cp.exec(...) to run an OS command on the server. The hardcoded OS command is a bash-style reverse shell using mkfifo, sh, and nc, causing the target to connect back to an attacker-supplied host and port. Operationally, the script requires four arguments: target domain, callback host, callback port, and a valid Bearer API token. It builds the URL as plain HTTP only, sets Authorization and Content-Type headers, serializes the payload as JSON, and prints the HTTP status code and raw response body. There is no HTTPS support, retry logic, or payload customization beyond callback host/port. Overall, this is a real exploit rather than a detector. It is best classified as OPERATIONAL: it contains a working hardcoded reverse-shell payload and directly targets the vulnerable code path, but it is not part of a larger exploitation framework and offers limited flexibility.

This repository is a standalone Python exploit lab and proof-of-concept for chaining two Flowise vulnerabilities: CVE-2025-58434 (password reset token disclosure leading to account takeover) and CVE-2025-59528 (authenticated JavaScript injection/RCE in the CustomMCP node). The main exploit logic is in exploit.py, which uses requests, argparse, and multiple modes: check, ato-mode, login-mode, rce-mode, and full-mode. Based on the README and visible code, the exploit initializes an HTTP session, optionally checks whether the target appears vulnerable, performs the forgot-password/reset-password flow to seize an account, logs in to obtain authenticated state, and then sends a malicious payload to the CustomMCP load-method endpoint to execute commands on the server. It supports either a custom command or a reverse-shell style command using attacker-provided lhost/lport. Repository structure is small and purposeful: exploit.py is the operational PoC; README.md documents the CVE chain, attack flow, usage, and detection ideas; requirements.txt only requires requests; docker-compose.yml plus docker/Dockerfile and docker/entrypoint.sh create a reproducible vulnerable lab using flowiseai/flowise:3.0.5 and Mailpit. The entrypoint script waits for Flowise to start and attempts to create admin and secondary users through several setup/register endpoints, making the lab easy to test. The exploit is not merely a detector: it contains active exploitation workflow and authenticated RCE capability. It is best classified as OPERATIONAL rather than WEAPONIZED because it is a standalone PoC with hardcoded/basic payload behavior rather than a reusable exploitation framework.

Repository is a standalone Python exploit/lab package for chaining two Flowise vulnerabilities: CVE-2025-58434 (password reset token exposure leading to account takeover) and CVE-2025-59528 (authenticated RCE through unsafe JavaScript evaluation in the CustomMCP node). The main exploit logic is in exploit.py, a CLI tool using requests with multiple modes: check, ato-mode, login-mode, rce-mode, and full-mode. Based on the README and visible code, it initializes an HTTP session, optionally checks vulnerability status, performs password reset abuse to set a new password, logs in to obtain cookies/token, and then sends an authenticated RCE request to the CustomMCP endpoint. It also supports direct token use, custom command execution, and reverse-shell parameters via --lhost/--lport. Repository structure is small and purposeful: exploit.py is the primary entry point; requirements.txt only depends on requests; README.md documents the CVE chain, attack flow, vulnerable endpoint, and usage; docker-compose.yml plus docker/Dockerfile and docker/entrypoint.sh create a reproducible Flowise 3.0.5 lab with Mailpit and bootstrap users. The lab container exposes Flowise on port 3000 and Mailpit on 8025, stores Flowise data under /root/.flowise, and uses local API calls to create accounts through several possible setup/register endpoints. This is not merely a detector: it contains exploitation workflow and authenticated post-auth command execution capability, making it an operational PoC rather than a simple scanner. No evidence suggests it belongs to a major exploit framework. The exploit targets web/network attack surfaces and fingerprints several Flowise API routes that defenders can monitor, especially forgot-password, reset-password, auth/login, and node-load-method/customMCP.

This repository is a small standalone Python proof-of-concept for CVE-2025-59528 targeting Flowise. It contains two files: a README with usage guidance and one executable script, poc.py, which is the sole exploit entry point. The script is not part of a larger exploitation framework. Operational flow: the script prompts the operator for a target URL/IP, email, password, and an arbitrary command. It normalizes the target URL, then sends a POST request to /api/v1/auth/login with JSON credentials. From the login response, it parses Set-Cookie headers and extracts three cookies: token, refreshToken, and connect.sid. It then crafts a second authenticated POST request to /api/v1/node-load-method/customMCP with JSON data containing a malicious JavaScript expression in mcpServerConfig. That expression uses process.mainModule.require("child_process") and execSync() to run the operator-supplied command on the server. Main exploit capability: authenticated remote command execution against a vulnerable Flowise instance. The exploit does not include persistence, lateral movement, or post-exploitation automation; it focuses on obtaining authenticated session state and triggering one command execution primitive. Because the payload is operator-controlled but basic and hardcoded into the PoC flow, the maturity is best classified as OPERATIONAL. Fingerprintable observables include the Flowise API paths /api/v1/auth/login and /api/v1/node-load-method/customMCP, the /canvas referer path, the custom header x-request-from: internal, and reuse of the cookies token, refreshToken, and connect.sid. These are useful for detection and traffic hunting. The exploit requires valid credentials and a target that exposes the vulnerable customMCP functionality.

This repository is a small standalone Python exploit for a Flowise exploit chain combining CVE-2025-58434 and CVE-2025-59528. The repository contains only two files: a minimal README naming the CVE and a single executable script, exploit.py, which is the full entry point and operational logic. The script supports two modes. In full-chain mode, it performs account takeover by calling the forgot-password API and extracting a leaked tempToken from the JSON response, then uses that token to reset the victim account password. Because the author notes a Flowise 3.0.5 login/API quirk, the script then requires a manual step: the operator logs into the web UI with the reset password, visits the API key page, and pastes the API key back into the script. In RCE-only mode, the operator can skip the takeover steps and provide an API key directly. After obtaining an API key, the exploit targets /api/v1/node-load-method/customMCP. It crafts a malicious JavaScript object expression for the mcpServerConfig input that invokes process.mainModule.require("child_process").execSync(...), enabling arbitrary command execution in the Flowise server context. The operator can either run a supplied command or generate a hardcoded mkfifo/netcat reverse shell payload. The script also checks /api/v1/version and warns that versions above 3.0.5 may be patched, explicitly noting a fix in 3.0.6. Overall, this is a real exploit rather than a detector. It is operational but not heavily weaponized: it includes a working payload and exploit chain, but relies on manual API key extraction in the default ATO flow and uses a basic hardcoded reverse shell.

This repository is a small standalone Python proof-of-concept exploit for CVE-2025-59528 affecting Flowise <= 3.0.5. The repo contains three files: the main exploit script (CVE-2025-59528.py), a README with setup and usage instructions, and a minimal requirements.txt listing the requests dependency. The exploit is not part of a larger framework. The Python script uses argparse to require three operator inputs: a target base URL, an API key, and a command string. Its core function, rce(), builds an authenticated POST request to the Flowise endpoint /api/v1/node-load-method/customMCP. The JSON body sets loadMethod to listActions and places a crafted JavaScript expression into inputs.mcpServerConfig. That JavaScript uses Node.js process.mainModule.require("child_process") and cp.execSync() to execute the supplied command on the server. The script then prints the HTTP status code and response body. Operationally, this is an authenticated web/network RCE exploit rather than a scanner or detector. It assumes the attacker already has a valid Flowise API key and that the target exposes the vulnerable endpoint. There is no vulnerability verification logic, no brute forcing, no persistence, and no post-exploitation automation; it simply delivers a command-execution payload and returns the server response. Because the payload is basic and operator-supplied rather than modularized into a reusable framework, the exploit is best classified as OPERATIONAL.

This repository is a small standalone proof-of-concept exploit for CVE-2025-59528 affecting Flowise AI <= 3.0.4. It contains two files: a Python exploit script (CVE-2025-59528_POC.py) and a README with vulnerability details, usage, and payload explanation. The Python script uses requests.Session and argparse, accepts target URL, email, password, and command arguments, then performs a two-step attack: first it authenticates to /api/v1/auth/login to obtain a session, then it sends a crafted POST request to /api/v1/node-load-method/customMCP. The exploit sets the x-request-from: internal header and injects a JavaScript expression into the mcpServerConfig field. That expression calls process.mainModule.require('child_process') and execSync() to run an arbitrary OS command on the server. The exploit is operational rather than just demonstrative because it performs real authenticated command execution, but it is still a simple POC with a hardcoded attack flow and no advanced post-exploitation features. No persistence, shell management, or exfiltration logic is included. The main fingerprintable targets are the Flowise API paths /api/v1/auth/login and /api/v1/node-load-method/customMCP, plus the required internal-origin header check. The README also notes a possible chain with CVE-2025-58434 for unauthenticated compromise, but that second vulnerability is not implemented in this repository.

Small two-file repository containing a single Python exploit script (RCE.py) and a brief README. The script is a chained exploit for Flowise that first performs reconnaissance by querying /api/v1/version, then abuses the forgot-password workflow to obtain a tempToken for a supplied victim email, resets that account's password, logs in with the new credentials, and finally exploits the Custom MCP node endpoint to achieve remote code execution. The RCE stage injects JavaScript into the mcpServerConfig field, uses Node.js process.mainModule.require('child_process') to invoke execSync, and runs a BusyBox netcat reverse shell command to connect back to an attacker-specified host and port. The exploit uses Python requests.Session for stateful HTTP interaction and argparse for CLI parameters. Repository purpose is clearly offensive exploitation rather than detection: it automates account takeover plus authenticated RCE against vulnerable Flowise instances.

This repository is a small standalone Python proof-of-concept exploit for CVE-2025-59528 affecting Flowise customMCP handling. The repo contains only two files: a README describing the vulnerability and usage, and a single executable Python script, CVE-2025-59528.py, which is the exploit entry point. The script uses argparse and requests, accepts a target URL and API key, and supports two operator modes: raw command execution or automatic generation of a Unix reverse shell payload. The exploit works by sending an authenticated POST request to /api/v1/node-load-method/customMCP with JSON containing a crafted mcpServerConfig value. That value is a JavaScript expression that invokes process.mainModule.require("child_process") and then executes the supplied command via execSync. This indicates the vulnerability is unsafe evaluation of attacker-controlled JavaScript in the Flowise customMCP node. The exploit therefore provides authenticated RCE rather than mere detection. Operationally, the script is simple but functional: it escapes backslashes and quotes in the command, constructs the malicious JavaScript wrapper, submits it with a 15-second timeout, and prints the HTTP status and first 500 bytes of the response. The reverse shell helper builds a classic mkfifo/netcat shell using /tmp/f and /bin/sh, requiring Unix-like target tooling and outbound network access. Because the payload is hardcoded and basic, but still directly usable, the exploit is best classified as OPERATIONAL rather than just a POC.

This repository is a small standalone exploit for CVE-2025-59528 affecting FlowiseAI Flowise CustomMCP. It contains two files: a README with vulnerability background, affected versions, exploitation notes, and usage examples; and a single Python entry-point script, exploit.py, implementing the attack logic. The exploit targets the Flowise endpoint /api/v1/node-load-method/customMCP by sending a crafted JSON body with loadMethod=listActions and a malicious inputs.mcpServerConfig value. The vulnerability arises because Flowise evaluates attacker-controlled input using JavaScript Function('return ' + input)(), enabling arbitrary JavaScript execution inside the Node.js process. The script converts this primitive into OS command execution by requiring child_process and calling exec() asynchronously. Capabilities implemented in the script include: version probing via /api/v1/version, authentication via /api/v1/auth/login or optional Basic Auth/cookie reuse, time-based vulnerability checking, blind command execution, and reverse shell delivery. Reverse shell support includes bash, netcat, and python variants, with the script indicating an auto-selection mode. Because command output is blind, the operator is expected to verify execution through callbacks or an inbound shell. The exploit is operational rather than a simple proof of concept because it includes authentication handling, payload construction, multiple execution modes, and reusable command/reverse-shell helpers. No evidence suggests it is fake or merely a detector. The attack surface is web/network-based, and the main fingerprintable target artifacts are the Flowise API paths, default port 3000, authentication cookie names, and the temporary file /tmp/f used by one reverse shell option.

Repository is a small standalone Python exploit PoC for chaining two Flowise vulnerabilities: CVE-2025-58434 (password reset token disclosure leading to account takeover) and CVE-2025-59528 (authenticated RCE through CustomMCP unsafe JavaScript evaluation). Structure is minimal: README.md documents the vulnerabilities, attack chain, usage, and remediation; DISCLAIMER.md contains legal language; requirements.txt lists the single dependency (requests); and main.py implements the exploit logic. The main capability is automated end-to-end exploitation. In default mode, main.py runs the full chain: request forgot-password for a supplied email, extract the leaked tempToken, reset the victim password, authenticate, collect cookies/session material, and then send a malicious request to the CustomMCP load-method endpoint to execute attacker-controlled code. The tool also supports modular operation for ATO-only, login-only, and RCE-only stages. Payload behavior is operational rather than framework-grade: it includes a built-in reverse shell generator using mkfifo + /bin/sh + nc, and also supports custom command execution. Fingerprintable targets in the exploit are Flowise API paths /api/v1/account/forgot-password, /api/v1/account/reset-password, /auth/login, and /api/v1/node-load-method/customMCP, plus the required x-request-from: internal header and authenticated cookies token, refreshToken, and connect.sid. The default payload touches local path /tmp/f and invokes /bin/sh and nc for shell access. Overall, this is a real exploit repository, not a detector: it is a single-file Python PoC intended to weaponize a natural vulnerability chain from unauthenticated account takeover to self-hosted Flowise remote code execution.

Repository contains a single Python exploit script and a short README. The main file, CVE-2025-8110.py, is a standalone exploit targeting Gogs and automates an authenticated remote code execution chain. It logs into a Gogs instance, creates an application token from /user/settings/applications, creates a new repository through /api/v1/user/repos, clones that repository locally with embedded credentials, adds a symlink named malicious_link pointing to .git/config, commits and pushes it, then uses the repository contents API at /api/v1/repos/{username}/{repo_name}/contents/malicious_link to write attacker-controlled content through the symlink. The written content is a crafted git config that sets sshCommand to a bash reverse shell payload. The intended effect is arbitrary command execution on the target, with a reverse shell connecting back to the attacker-supplied host and port. The script supports an intercepting proxy at localhost:8080, disables TLS verification, and requires valid credentials plus repository creation capability. The README mainly documents command-line usage, but it inconsistently references CVE-2025-59528 while the script identifies itself as CVE-2025-8110; functionally, the code is clearly an exploit rather than a detector.

This repository is primarily a collection of HackTheBox writeups, but it also contains real exploit automation in the `VariaType/` directory. The actionable exploit consists of one Bash orchestrator (`exploit_variatype.sh`) and four Python phase scripts. The exploit is not tied to a common framework like Metasploit; it is custom automation for a multi-stage Linux target compromise. Main exploit capabilities: (1) reconnaissance and extraction of credentials from an exposed `.git` repository on `portal.variatype.htb`; (2) login and LFI verification against `download.php`; (3) preparation of malicious font files and a crafted designspace document to exploit CVE-2025-66034 in fontTools varLib, causing arbitrary file write of a PHP webshell to `/var/www/portal.variatype.htb/public/files/shell.php`; (4) privilege escalation to user `steve` using a ZIP filename command injection payload associated with CVE-2024-25082, which appends an attacker SSH key into `/home/steve/.ssh/authorized_keys`; and (5) privilege escalation to root by abusing `sudo /usr/bin/python3 /opt/font-tools/install_validator.py` with a URL-encoded absolute path traversal to write the attacker’s public key into `/root/.ssh/authorized_keys`. Repository structure: most files are Markdown writeups for HTB machines/challenges. Only 5 files contain exploit code, all under `VariaType/`. `phase1_git_extract.py` handles exposed Git extraction and credential recovery. `phase2_rce_exploit.py` generates malicious font/designspace artifacts for the webshell stage, though upload is partly left manual in that script. `phase3_privesc_steve.py` generates an SSH key, builds an evil ZIP with a filename-based command injection payload, serves it over HTTP, and attempts to place it on the target for later processing. `phase4_privesc_root.py` serves a root public key and invokes the vulnerable validator script over SSH as steve to gain root SSH access. `exploit_variatype.sh` ties the phases together into a mostly automated end-to-end attack. Overall, this is a valid exploit repository with operational code, not just detection logic. The exploit targets a web-exposed Linux application stack and culminates in full root compromise with SSH persistence.

This repository contains a small two-stage exploit chain for the Hack The Box 'Silentium' target. The structure is simple: one Bash script for user enumeration, one Python script for remote code execution, a README describing the workflow, and a large username wordlist. CVE-2025-58434.sh iterates through users.txt, builds email addresses in the form <user>@silentium.htb, and POSTs JSON to http://staging.silentium.htb/api/v1/account/forgot-password. It treats any response other than HTTP 404 as evidence of a potentially valid account, making it an information-disclosure/user-enumeration exploit rather than mere detection. CVE-2025-59528.py is the main RCE component: it accepts target host, Bearer token, listener host, and listener port; sends a POST request to /api/v1/node-load-method/customMCP; and injects JavaScript into the mcpServerConfig field. The injected code uses process.mainModule.require('child_process').execSync(...) to execute a Bash reverse shell command on the target. The payload creates a named pipe at /tmp/f and uses nc to connect back to the attacker. Overall, the repository is operational exploit code rather than a framework module: it automates reconnaissance and exploitation against a vulnerable web/API application, with the final outcome being authenticated remote code execution and a reverse shell.

This repository is a small standalone exploit repo containing two files: a README describing the exploit chain and one Python script, flowise_chain.py, which is the operational entry point. The script targets Flowise <= 3.0.5 and chains two vulnerabilities: CVE-2025-58434 for unauthenticated account takeover and CVE-2025-59528 for authenticated remote code execution. The exploit flow is straightforward: it optionally checks the target version via /api/v1/version, abuses /api/v1/account/forgot-password to obtain a password reset tempToken for a known email address, then submits that token to /api/v1/account/reset-password to set a new password. Because the author notes a Flowise 3.0.5 login quirk, the script does not automate API-key extraction after reset; instead it instructs the operator to log into /login manually and copy the API key from /apikey. If an API key is already known, the account takeover stage can be skipped entirely. For code execution, the script sends a crafted JSON request to /api/v1/node-load-method/customMCP with a Bearer API key. The payload injects JavaScript into the CustomMCP node configuration and uses process.mainModule.require("child_process").execSync(...) to run arbitrary OS commands. The operator can either run a single command (default: id) or generate a hardcoded mkfifo/netcat reverse shell that uses /tmp/f and /bin/sh and connects back to an attacker-supplied LHOST:LPORT. Overall, this is a real exploit rather than a detector. It is not part of a common exploitation framework. Its capabilities are account takeover, password reset abuse, authenticated API abuse, arbitrary command execution, and reverse shell delivery. The implementation is operational but basic: payloads are hardcoded and interaction is partly manual, especially for API key retrieval.

This repository is a small standalone Python exploit for Flowise versions earlier than 3.0.5. It contains only two files: a minimal README listing CVE-2025-58434 and CVE-2025-59528, and the main exploit script flowise-rce-3.0.5.py. The script uses argparse for four required inputs: target URL, victim email, new password, and command to execute. Its workflow is straightforward: first it attempts login with the supplied credentials; if login fails, it abuses the password reset flow by calling /api/v1/account/forgot-password, extracting a tempToken from the JSON response, and submitting /api/v1/account/reset-password to set a new password for the target account. After successful authentication, it sends a malicious payload to /api/v1/node-load-method/customMCP with loadMethod=listActions and a crafted mcpServerConfig value containing JavaScript. That JavaScript imports Node's child_process module via process.mainModule.require and runs the attacker-supplied command with execSync. If the first RCE request returns 401, the script retries after adding the x-request-from: internal header. Overall, the exploit provides chained account takeover plus authenticated remote code execution against vulnerable Flowise API endpoints.

This repository is a small standalone exploit repo with 2 files: a README describing the exploit chain and one Python script, flowise_chain.py, which is the operational entry point. The script targets Flowise <= 3.0.5 and chains two vulnerabilities: CVE-2025-58434 for unauthenticated account takeover and CVE-2025-59528 for authenticated remote code execution. Repository structure is simple and purpose-built. README.md documents the affected versions, prerequisites, and example usage. flowise_chain.py implements the full workflow: version check, password-reset token theft, password reset, manual API key acquisition, and final RCE trigger. Main capabilities: 1. Version probing via GET /api/v1/version. 2. Unauthenticated password reset token disclosure by POSTing to /api/v1/account/forgot-password with a known victim email and extracting user.tempToken from the JSON response. 3. Password reset by POSTing the leaked token to /api/v1/account/reset-password. 4. Manual operator-assisted login to /login and API key collection from /apikey due to a documented Flowise 3.0.5 authentication quirk. 5. Authenticated RCE by POSTing to /api/v1/node-load-method/customMCP with a malicious JavaScript expression in inputs.mcpServerConfig. The injected code uses process.mainModule.require("child_process").execSync(...) to run arbitrary commands. 6. Optional reverse shell generation using a hardcoded mkfifo + nc payload that connects back to an operator-supplied LHOST:LPORT. The exploit is not just a detector; it performs real state-changing actions on the target and can yield command execution. It is operational rather than weaponized because it includes a working payload and exploit chain, but customization is limited and it is not embedded in a larger exploitation framework.