CVE-2024-36791: Flowise RCE Exploitation — Detection and Hardening Guide

---
title: Flowise RCE - Suspicious Node.js Child Process
id: 8a4b2c19-1d3e-4f5a-9b6c-2d3e4f5a6b7c
status: experimental
description: Detects potential exploitation of CVE-2024-36791 by identifying the Node.js Flowise parent process spawning a shell or network tool.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2024-36791
author: Security Arsenal
date: 2025/03/05
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith: '/node'
    ParentCommandLine|contains: 'flowise'
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/zsh'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/python'
      - '/perl'
  condition: selection
falsepositives:
  - Legitimate administration by developers testing nodes that execute shell scripts
level: high
---
title: Flowise RCE - Windows Node Spawning PowerShell
id: 9c5d3e20-2e4f-5g6b-0c7d-3e4f5g6a7b8d
status: experimental
description: Detects exploitation attempts on Windows where the Flowise Node process spawns cmd.exe or powershell.exe.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2024-36791
author: Security Arsenal
date: 2025/03/05
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentProcessName|endswith: '\node.exe'
    ParentCommandLine|contains: 'flowise'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  condition: selection
falsepositives:
  - Administrative debugging
level: high

// Hunt for Flowise RCE via suspicious child processes
DeviceProcessEvents
| where InitiatingProcessFileName in~ ("node.exe", "node")
| where InitiatingProcessCommandLine contains "flowise"
| where FileName in~ ("bash", "sh", "dash", "cmd.exe", "powershell.exe", "pwsh", "python", "python3", "perl", "curl", "wget", "nc")
| project Timestamp, DeviceName, AccountName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, InitiatingProcessParentFileName
| order by Timestamp desc

-- Hunt for Flowise (Node) parent spawning suspicious shells
SELECT Parent.Name AS ParentProcess, Parent.Pid AS ParentPid,
       Name AS ChildProcess, Pid, CommandLine, Username
FROM pslist()
WHERE Parent.Name =~ "node"
  AND Parent.CommandLine =~ "flowise"
  AND Name IN ("bash", "sh", "zsh", "powershell.exe", "cmd.exe", "python", "python3")

#!/bin/bash
# Flowise CVE-2024-36791 Remediation Script
# Checks version and updates to latest patched version

FLOWISE_DIR="/path/to/flowise" # Adjust if running locally without Docker
SERVICE_NAME="flowise"

echo "[+] Checking Flowise status..."

# Check if running via Docker (Common deployment)
if docker ps --format '{{.Names}}' | grep -qi flowise; then
    echo "[*] Flowise detected running in Docker."
    echo "[*] Pulling latest image (v1.6.5+)..."
    # Assuming standard container name usage, adjust as needed
    docker pull flowiseai/flowise:latest
    echo "[*] Restarting container..."
    docker restart $(docker ps -q --filter ancestor=flowiseai/flowise)
    echo "[+] Docker Flowise updated."

# Check if running via npm/pm2
elif command -v pm2 &> /dev/null && pm2 list | grep -qi flowise; then
    echo "[*] Flowise detected running via PM2."
    echo "[*] Stopping service..."
    pm2 stop $SERVICE_NAME
    echo "[*] Updating Flowise..."
    cd $FLOWISE_DIR
    npm update flowise
    echo "[*] Starting service..."
    pm2 start $SERVICE_NAME
    pm2 save
    echo "[+] Flowise updated via npm."
else
    echo "[!] Could not automatically determine Flowise deployment method."
    echo "[!] Please manually update Flowise to version 1.6.5 or higher."
fi

echo "[+] Verifying update..."
# Note: Verification command depends on install method.
# 'flowise --version' usually works if installed globally.