Alex-Elttam

**Name of the Vulnerable Software and Affected Versions** Flowise versions prior to 3.1.3 **Description** Authenticated users can achieve remote code execution in the Custom MCP node when the `CUSTOM MCP PROTOCOL` is set to stdio. This occurs through the manipulation of command arguments and environment variables. Specifically, attackers can exploit the `PYTHONWARNINGS` and `BROWSER` environment variables when using python3, or utilize the root working directory with node to bypass validation and execute arbitrary system commands. **Recommendations** Update Flowise to version 3.1.3 or later.

**Name of the Vulnerable Software and Affected Versions** Flowise versions prior to 3.1.3 **Description** Authenticated users can achieve arbitrary code execution by escaping the vm2 JavaScript sandbox. This is possible by exploiting a validation bypass in the moment locale, where an attacker can create a fake String object with a `match` function. This technique bypasses path traversal checks, allowing the loading and execution of malicious JavaScript files stored in the document store outside the sandbox environment. **Recommendations** Update Flowise to version 3.1.3 or later.

**Name of the Vulnerable Software and Affected Versions** Label Studio versions prior to 1.11.0 **Description** The issue affects Label Studio's SSRF protections, which can be bypassed to access internal web servers. This is because the current SSRF validation is done by executing a single DNS lookup to verify that the IP address is not in an excluded subnet range. This protection can be bypassed by either using HTTP redirection or performing a DNS rebinding attack. The vulnerability poses a significant risk in cloud environments, as it can be used to access internal web servers and partially compromise the confidentiality of those internal servers. **Recommendations** For versions prior to 1.11.0, update to version 1.11.0 or later to resolve the issue. As a temporary workaround, consider validating the destination IP address before sending the request to ensure it is not in the deny list. Restrict access to internal cloud API IP ranges to minimize the risk of compromising cloud credentials.

**Name of the Vulnerable Software and Affected Versions** Label Studio versions prior to 1.10.1 **Description** The remote import feature in Label Studio allowed users to import data from a remote web source, which could be abused to download a HTML file that executed malicious JavaScript code in the context of the Label Studio website. This could result in an attacker performing malicious actions on Label Studio users if they visit the crafted avatar image. For example, an attacker can craft a JavaScript payload that adds a new Django Super Administrator user if a Django administrator visits the image. The `Content-Type` of the response was determined by the file extension, since `mimetypes.guess type` guesses the `Content-Type` based on the file extension. An attacker could import a `.html` file that would execute JavaScript when visited. The API endpoint `/api/projects/{project id}/file-uploads?ids=[{download id}]` was used to retrieve the downloaded file path. **Recommendations** For all user-provided files that are downloaded by Label Studio, set the `Content-Security-Policy: sandbox;` response header when viewed on the site. Restrict the allowed file extensions that may be downloaded. Update to version 1.10.1 or later, which contains a patch for this issue.

**Name of the Vulnerable Software and Affected Versions** Label Studio versions prior to 1.9.2 **Description** The issue is a cross-site scripting (XSS) vulnerability that could be exploited when an authenticated user uploads a crafted image file for their avatar that gets rendered as a HTML file on the website. This could result in an attacker performing malicious actions on Label Studio users if they visit the crafted avatar image. For example, an attacker can craft a JavaScript payload that adds a new Django Super Administrator user if a Django administrator visits the image. The vulnerability is due to the use of Django's built-in `serve` view, which determines the `Content-Type` of the response by the file extension in the URL path, and the lack of server-side validation of the file extension. **Recommendations** For versions prior to 1.9.2, validate the file extension on the server side, not in client-side code. Remove the use of Django's `serve` view and implement a secure controller for viewing uploaded avatar images. Consider saving file content in the database rather than on the filesystem to mitigate against other file related vulnerabilities. Avoid trusting user controlled inputs. Update to version 1.9.2 or later to fix the issue.

**Name of the Vulnerable Software and Affected Versions** Label Studio versions prior to 1.9.2post0 **Description** The vulnerability allows attackers to construct a filter chain and exploit Django's Object Relational Mapper (ORM) to leak sensitive fields, including account password hashes, character by character. This is achieved by insecurely setting filters for filtering tasks. Additionally, a hard-coded secret key in Label Studio can be used to forge session tokens of any user by exploiting this vulnerability. The issue affects all versions of Label Studio prior to 1.9.2post0. **Recommendations** For Label Studio versions prior to 1.9.2post0, upgrade to version 1.9.2post0 or later to address the vulnerability. As a temporary workaround, consider restricting access to the `/api/dm/views/{viewId}` API endpoint and the `PreparedTaskManager` to minimize the risk of exploitation. Avoid using unsanitized values for constructing filters and validate filter values against an allow list before performing any queries.

**Name of the Vulnerable Software and Affected Versions** Label Studio versions prior to 1.8.2 **Description** There is a vulnerability in Label Studio that can be chained with an Object Relational Mapper (ORM) Leak vulnerability to impersonate any account on the platform. An attacker could exploit these vulnerabilities to escalate their privileges from a low privilege user to a Django Super Administrator user. The vulnerability is due to a hardcoded Django SECRET KEY in the application settings, which can be used to forge session tokens for all users on Label Studio. The estimated number of potentially affected devices worldwide is not specified. However, the vulnerability can be exploited to impersonate any account on the platform, which could have significant consequences. Technical details about exploitation include the use of the hardcoded SECRET KEY to forge session tokens. An attacker can exploit the ORM Leak vulnerability to retrieve the full password hash of an account, and then use the hardcoded SECRET KEY to create a forged session token for that account. **Recommendations** For Label Studio versions prior to 1.8.2, update to a version >= 1.8.2 to mitigate the likelihood of an attacker exploiting these vulnerabilities to impersonate all accounts on the platform. As a temporary workaround, consider restricting access to sensitive features and data until the update can be applied.