GHSA-r745-8hwv-h473

Описание

Summary

The OAuth2 token refresh endpoint (POST /api/v1/oauth2-credential/refresh/:credentialId) is unauthenticated by design (it is in the public whitelist) and performs a server-side HTTP request to a credential-controlled URL (accessTokenUrl) without SSRF protections. In runtime validation, this endpoint was reachable without auth, triggered outbound POST requests to an attacker-controlled server, and reflected the full remote response body to the caller (tokenInfo), confirming non-blind SSRF and credential secret exfiltration.

Details

The vulnerability is in dist/routes/oauth2/index.js (container runtime build), under path prefix /api/v1/oauth2-credential.

Confirmed in runtime code:

1. Unauthenticated route via whitelist

   • dist/utils/constants.js includes:
     • /api/v1/oauth2-credential/callback
     • /api/v1/oauth2-credential/refresh
   • dist/index.js auth middleware uses:
     • const isWhitelisted = whitelistURLs.some((url) => req.path.startsWith(url))
   • Therefore /api/v1/oauth2-credential/refresh/:credentialId is treated as whitelisted.

2. User-controlled SSRF target

   • In refresh handler (dist/routes/oauth2/index.js):
     • loads credential by credentialId
     • decrypts credential data
     • reads accessTokenUrl
     • executes:
       • axios.post(tokenUrl, new URLSearchParams(refreshRequestData).toString(), ...)
   • No secureAxiosRequest() / denylist wrapper is used in this path.

3. Non-blind response reflection

   • Response returns:
     • tokenInfo: { ...tokenData, ... }
   • tokenData is the attacker/internal server response body.

4. Secrets sent to SSRF target

   • Request body includes:
     • client_id
     • client_secret
     • grant_type=refresh_token
     • refresh_token

PoC

Environment used

• flowiseai/flowise:latest container (localhost:3000)
• Attacker server (localhost:18081) returning JSON

Step 1: Start attacker server

Step 2: Create OAuth2 credential with attacker accessTokenUrl (authenticated action)

In validation, this was done via authenticated API path (credential creation requires auth/permissions), then refresh was tested publicly.

Resulting credential ID used in runtime validation:

• 24c0b18b-ff6e-4d81-a9a7-26ea8ddccdef

Step 3: Trigger refresh without auth

Observed response:

Attacker server logs captured:

This confirms:

• unauthenticated trigger,
• server-side POST to attacker-controlled URL,
• exfiltration of OAuth2 secrets in POST body,
• full response reflection to client (tokenInfo).

Impact

• Vulnerability class: Non-blind SSRF + sensitive secret exfiltration.
• Who can set up attack: Any authenticated user who can create/update OAuth2 credentials.
• Who can trigger attack: Anyone who knows a valid OAuth2 credential UUID (refresh endpoint is public/whitelisted).
• Technical impact:
  • outbound SSRF to attacker/internal targets,
  • direct leak of client_secret and refresh_token to SSRF target,
  • direct response read from target via API response (tokenInfo).
• Deployment impact:
  • cloud/internal network reachability can expose metadata/internal services depending on egress controls.