flowise-chatflows-exposure: Flowise AI - Unauthenticated Chatflows API Exposure

id: flowise-chatflows-exposure

info:
  name: Flowise AI - Unauthenticated Chatflows API Exposure
  author: comradezephyr
  severity: high
  description: |
    Flowise AI instance is exposed without authentication, allowing unauthorized access to visual LLM chatflows and integration configurations.
  reference:
    - https://github.com/FlowiseAI/Flowise
    - https://docs.flowiseai.com/
  metadata:
    verified: true
    max-request: 1
    vendor: flowiseai
    product: flowise
    shodan-query: title:"Flowise"
  tags: flowise,flowiseai,exposure,unauth,mlops,ai,llm

http:
  - raw:
      - |
        GET /api/v1/chatflows HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "flowData") && contains(body, "\"deployed\"")'
          - 'status_code == 200'
        condition: and

    extractors:
      - type: regex
        part: body
        group: 1
        regex:
          - '"name"\s*:\s*"([^"]+)"'
# digest: 4b0a00483046022100d2e549120a5c94bca84f95a796af74c7ccdf390dfc8faee55e057e944af861b9022100ed28818fde5e5c6334624d91b3a8346e721a7100bc040b1acb6eb709086c7d24:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.