## https://sploitus.com/exploit?id=E29B9FB2-9AA8-5431-8E7D-79CED6B6A67A
# โ ๏ธ Langflow RCE Exploit Scanner (CVE-2025-3248)
This Python-based scanner automates the detection of **unauthenticated Remote Code Execution (RCE)** vulnerabilities in Langflow instances via **CVE-2025-3248**. It uses a proof-of-concept payload that abuses the `/api/v1/validate/code` endpoint to execute arbitrary shell commands.
## ๐จ CVE Details
- **CVE**: CVE-2025-3248
- **Impact**: Unauthenticated Remote Code Execution
- **Component**: Langflow API (`/api/v1/validate/code`)
- **Exploit**: Injection via dynamic code evaluation
- **Risk**: Critical
## ๐ Features
- ๐ Batch scan multiple targets from a file
- โก๏ธ Multi-threaded for fast performance
- โ Validates RCE by checking for expected command output (e.g., `uid=`)
- ๐ Outputs vulnerable targets to `vuln.txt`
- ๐งฑ Clean, modular code structure
## ๐ฆ Requirements
- Python 3.x
- `requests` library
Install dependencies:
```
pip install requests
```
## ๐ Usage
1. Add targets (with or without http(s)://) to targets.txt, one per line:
```
http://example.com
192.168.1.100:7860
https://target.net
```
2. Run the script:
```
python3 scanner.py
```
3. Check vuln.txt for successful exploitation results:
```
http://vulnerable-target.com | uid=1000(user) gid=1000(user) groups=1000(user)
```
## โ๏ธ Configuration
Modify the following values at the top of the script as needed:
COMMAND: Shell command to execute (default: id)
EXPECTED_SUBSTRING: Substring to confirm execution (default: uid=)
THREADS: Number of concurrent threads (default: 20)
## ๐ Disclaimer
This tool is provided for educational and authorized security testing only. Unauthorized access to systems is illegal and unethical. You are solely responsible for your use of this code.
## ๐ Credits
Exploit Author: ynsmroztas
Script Refactor: ill deed
## ๐ License
MIT License โ use responsibly.