AI Sec Watch

OpenTelemetry's OTLP exporter (a tool for sending telemetry data, which is information about how software is performing) reads error response bodies from servers with no limit on size, potentially causing memory exhaustion if an attacker controls the server or intercepts the connection. This could crash applications by filling up their available memory.

Pipecat's LivekitFrameSerializer contains a critical vulnerability where its deserialize() method uses pickle.loads() (a Python function that reconstructs objects from binary data) on untrusted WebSocket client data without validation. An attacker can send a malicious pickle payload to execute arbitrary code on the server, potentially compromising the entire system. This affects servers using the now-deprecated LivekitFrameSerializer, especially if exposed to external networks.

Flowise, a tool for building customized AI workflows with a drag-and-drop interface, had a security flaw in versions before 3.1.0 where a speech-generation endpoint didn't require authentication (authorization bypass, where access controls are bypassed by attackers) and could decrypt stored API keys when given a credential ID. This allowed attackers to retrieve sensitive credentials like OpenAI API keys without proper permission checks.

Flowise, a tool that lets users build custom AI workflows through a drag-and-drop interface, had a security flaw in versions before 3.1.0 where the public API endpoint (GET /api/v1/public-chatflows/:id) exposed sensitive data without filtering. The flaw revealed credential IDs, plaintext API keys (secret codes used to access other services), and password fields in the raw workflow data, making it possible for unauthorized people to see this sensitive information.

Flowise, a tool that lets users build custom AI flows through a visual interface, had a mass assignment vulnerability (a bug where user input can change database fields that shouldn't be user-controllable) in versions before 3.1.0 that allowed authenticated users to overwrite existing document storage objects and access objects from other workspaces, potentially breaking access controls (IDOR, or insecure direct object references, where an attacker can access resources by guessing their IDs).

Flowise, a tool for building customized AI language model workflows through a visual interface, had a security flaw in versions before 3.1.0 that let attackers reset any user's password without authorization. The vulnerability existed because the password reset function didn't verify that a valid reset token had been created, so attackers could submit a request with an empty or null token value (which is the default) to change a user's password if they knew the victim's email address.

Flowise, a tool for building AI workflows using a drag-and-drop interface, had a security flaw in versions before 3.1.0 where password reset links were sent over HTTP (unencrypted internet connection) instead of HTTPS (encrypted connection). This allowed attackers on the same network, such as on public Wi-Fi, to intercept these reset links through a MITM attack (man-in-the-middle attack, where someone secretly reads messages between two parties) and take over user accounts.

Flowise, a tool for building customized AI workflows with a drag-and-drop interface, had a security flaw in versions before 3.1.0 that let attackers bypass authentication (skip the login process) and steal OAuth 2.0 access tokens (credentials that grant permission to access other services). Attackers could access public chatflow configuration endpoints (URLs that show workflow settings) to find OAuth credential identifiers and use them to obtain valid access tokens without needing to log in.

Flowise, a tool with a drag-and-drop interface for building customized AI workflows, had security flaws in its request-blocking system before version 3.1.0. These flaws allowed attackers to bypass security protections through DNS Rebinding (a technique where a domain name's IP address changes between security checks) or by exploiting a default configuration that didn't enforce any blocklist, potentially enabling SSRF attacks (Server-Side Request Forgery, where an attacker tricks a server into making unwanted requests).