CVE-2024-36420: Flowise 1.4.3 - Arbitrary File Read
HoneyLabs honeypots recorded 4 probes matching CVE-2024-36420 from 4 distinct source IP addresses in the last 7 days, of which 3 on interactive sensors. Severity is rated high.
3 sources probed for CVE-2024-36420 on the interactive sensors. None of them sent the exploit payload.
What the sensors show
Probes arrived on 2 of the 7 days in this window. The busiest day was 2026-11-05, with 3. One address, 165.49.100.107, sent 25% of them. The largest source network was AS5650 (Frontier Communications of America, Inc.), with 50% of the probes from 2 addresses. Over the last 90 days the sensors recorded 54 probes for it.
Request paths that identify it
- /api/v1/openai-assistants-file
Addresses probing it
| Source IP | Probes | Network | Country |
|---|---|---|---|
| 165.49.100.107 | 1 | Frontier Communications of America, Inc. | United States |
| 167.253.10.43 | 1 | Windstream Communications LLC | United States |
| 170.205.5.170 | 1 | Frontier Communications of America, Inc. | United States |
| 66.92.21.200 | 1 | Psychz Networks | United States |
Networks it comes from
| ASN | Organisation | Probes | Source IPs |
|---|---|---|---|
| AS5650 | Frontier Communications of America, Inc. | 2 | 2 |
| AS40676 | Psychz Networks | 1 | 1 |
| AS7029 | Windstream Communications LLC | 1 | 1 |
Where it comes from
| Country | Probes |
|---|---|
| United States | 4 |
Captured requests
- /api/v1/openai-assistants-file
Requests the interactive sensors answered
- GET /api/v1/openai-assistants-file/download?fileName=../../../home/node/.flowise/encryption.key
- GET /api/v1/openai-assistants-file/download?fileName=../../../root/.flowise/database.sqlite
- GET /api/v1/openai-assistants-file/download?fileName=../../../root/.flowise/encryption.key
HTTP client fingerprints
- b11cuq050_00050812_107c8b82
- b11cun050_00040017_6b90553b
CVE report
Open a specific CVE from the CVE tracker.