Flowise Unauthenticated Property Injection via Ungated overrideConfig Spread in Prediction API

#!/usr/bin/env bash
# check_cve_2026_69258.sh — Detect CVE-2026-69258 (Flowise overrideConfig property injection)
# Usage: bash check_cve_2026_69258.sh <FLOWISE_BASE_URL>
# Exit codes: 0=VULNERABLE, 1=PATCHED, 2=UNKNOWN

set -euo pipefail

TARGET="${1:?Usage: $0 <FLOWISE_BASE_URL>}"
TARGET="${TARGET%/}"  # strip trailing slash

echo "[*] Checking CVE-2026-69258 against: $TARGET"

# Step 1: Get Flowise version via API
VERSION=$(curl -sf --max-time 10 "${TARGET}/api/v1/version" 2>/dev/null | jq -r '.version // empty' 2>/dev/null || true)

if [ -z "$VERSION" ]; then
    # Fallback: try the root page or other endpoints
    VERSION=$(curl -sf --max-time 10 "${TARGET}/api/v1/node-icon/chatOpenAI" -o /dev/null -w '%{http_code}' 2>/dev/null || true)
    if [ "$VERSION" = "000" ] || [ -z "$VERSION" ]; then
        echo "[!] Could not connect to Flowise instance at $TARGET"
        echo "UNKNOWN"
        exit 2
    fi
    echo "[!] Connected but could not determine version. Checking endpoint behavior."
    VERSION="unknown"
fi

if [ "$VERSION" != "unknown" ]; then
    echo "[*] Detected Flowise version: $VERSION"

    # Compare version — vulnerable if < 3.1.3
    MAJOR=$(echo "$VERSION" | cut -d. -f1)
    MINOR=$(echo "$VERSION" | cut -d. -f2)
    PATCH=$(echo "$VERSION" | cut -d. -f3)

    if [ "$MAJOR" -lt 3 ] 2>/dev/null; then
        echo "[!] Version $VERSION is below 3.1.3"
        echo "VULNERABLE"
        exit 0
    elif [ "$MAJOR" -eq 3 ] && [ "$MINOR" -lt 1 ] 2>/dev/null; then
        echo "[!] Version $VERSION is below 3.1.3"
        echo "VULNERABLE"
        exit 0
    elif [ "$MAJOR" -eq 3 ] && [ "$MINOR" -eq 1 ] && [ "$PATCH" -lt 3 ] 2>/dev/null; then
        echo "[!] Version $VERSION is below 3.1.3"
        echo "VULNERABLE"
        exit 0
    elif [ "$MAJOR" -eq 3 ] && [ "$MINOR" -eq 1 ] && [ "$PATCH" -ge 3 ] 2>/dev/null; then
        echo "[+] Version $VERSION is >= 3.1.3 (patched)"
        echo "PATCHED"
        exit 1
    elif [ "$MAJOR" -gt 3 ] 2>/dev/null; then
        echo "[+] Version $VERSION is >= 3.1.3 (patched)"
        echo "PATCHED"
        exit 1
    fi
fi

# Step 2: Check if public chatflows exist (non-destructive)
PUBLIC_FLOWS=$(curl -sf --max-time 10 "${TARGET}/api/v1/public-chatflows" 2>/dev/null || true)
if echo "$PUBLIC_FLOWS" | jq -e '. | length > 0' >/dev/null 2>&1; then
    FLOW_COUNT=$(echo "$PUBLIC_FLOWS" | jq '. | length')
    echo "[!] Found $FLOW_COUNT public chatflow(s) — attack surface is live"
else
    echo "[*] No public chatflows found or endpoint not accessible"
fi

echo "[*] Version-based check inconclusive"
echo "UNKNOWN"
exit 2