CVE-2025-59528: Flowise RCE Under Active Exploitation — Detection and Hardening

---
title: Flowise CVE-2025-59528 - Suspicious Child Process Spawn
id: 8a4b2c1d-9e0f-4a5b-8c2d-1e4f5a6b7c8d
status: experimental
description: Detects suspicious shell processes spawned by the Flowise (Node.js) parent process, indicative of RCE exploitation.
references:
  - https://bleepingcomputer.com/news/security/max-severity-flowise-rce-vulnerability-now-exploited-in-attacks/
author: Security Arsenal
date: 2025/01/15
tags:
  - attack.execution
  - attack.t1059
  - cve.2025.59528
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|contains: 'node'
    ParentImage|contains: 'flowise'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  condition: selection
falsepositives:
  - Legitimate administrative debugging (rare)
level: critical
---
title: Flowise Linux - Shell Spawn via Node Process
id: 9c5d3e2f-1a2b-3c4d-5e6f-7a8b9c0d1e2f
status: experimental
description: Detects shell spawning by Node.js processes on Linux, potentially indicating Flowise exploitation.
references:
  - https://bleepingcomputer.com/news/security/max-severity-flowise-rce-vulnerability-now-exploited-in-attacks/
author: Security Arsenal
date: 2025/01/15
tags:
  - attack.execution
  - attack.t1059
  - cve.2025.59528
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith: '/node'
    ParentImage|contains: 'flowise'
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/zsh'
  condition: selection
falsepositives:
  - Legitimate administrative debugging
level: critical

// Hunt for suspicious child processes of Flowise Node.js instances
DeviceProcessEvents
| where InitiatingProcessFileName =~ "node.exe" or InitiatingProcessFileName =~ "node"
| where InitiatingProcessFolderPath contains "flowise"
| where FileName in~ ("powershell.exe", "cmd.exe", "pwsh.exe", "bash", "sh", "zsh", "curl", "wget")
| project Timestamp, DeviceName, InitiatingProcessCommandLine, CommandLine, FileName, FolderPath, AccountName
| order by Timestamp desc

-- Hunt for Flowise processes spawning shells on Linux/Unix endpoints
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime,
       Parent.Pid AS ParentPid, Parent.Name AS ParentName, Parent.CommandLine AS ParentCmd
FROM pslist()
WHERE Parent.Name =~ "node"
  AND Parent.CommandLine =~ "flowise"
  AND Name IN ("bash", "sh", "zsh", "dash", "python", "perl")

#!/bin/bash
# Flowise CVE-2025-59528 Emergency Remediation Script
# Use this script to identify running Flowise instances and verify/update the version.

echo "[+] Checking for running Flowise processes..."
FLOWISE_PIDS=$(pgrep -f "flowise")

if [ -z "$FLOWISE_PIDS" ]; then
    echo "[-] No Flowise processes detected."
else
    echo "[!] Flowise is running. PIDs: $FLOWISE_PIDS"
    echo "[!] Recommendation: Stop the service immediately to patch."
    # Uncomment to kill process (CAUTION)
    # pkill -f "flowise"
fi

echo "[+] Checking for Flowise installation via NPM..."
if command -v npm &> /dev/null; then
    npm list -g flowise 2>/dev/null || echo "Flowise not found globally."
fi

echo "[+] Checking Docker containers for Flowise..."
if command -v docker &> /dev/null; then
    docker ps --filter "ancestor=flowiseai/flowise" --format "table {{.ID}}\t{{.Image}}\t{{.Status}}"
    echo "Action: Pull the latest image: docker pull flowiseai/flowise:latest"
    echo "Action: Recreate containers with the new image."
fi

echo "[+] Remediation Steps:"
echo "1. Update Flowise to the latest patched version immediately."
echo "2. Restrict access to the Flowise UI (port 3000) via IP whitelisting or VPN."
echo "3. Review logs for unusual shell activity or file modifications."