FlowiseDB vulnerable to SQL Injection by authenticated users

Summary

import functions are vulnerable.

• importChatflows
• importTools
• importVariables

Details

Authenticated user can call importChatflows API, import json file such as AllChatflows.json. but Due to insufficient validation to chatflow.id in importChatflows API, 2 issues arise.

Issue 1 (Bug Type)

1. Malicious user creates AllChatflows.json file by adding ../ and arbitrary path to the chatflow.id of the json file.

   {
     "Chatflows": [
       {
         "id": "../../../../../../apikey",
         "name": "clickme",
         "flowData": "{}"
       }
     ]
   }
   

2. Victim download this file, and import this to flowise.
3. When victim click created chatflow, victim access to flowise:3000/canvas/{chatflow.id}.

Issue 2 (Vulnerability Type) importChatflows API use unsafe SQL Query.

// packages/server/src/services/chatflows/index.ts
const importChatflows = async (newChatflows: Partial[]): Promise => {
        try {
        const appServer = getRunningExpressApp()

        // step 1 - check whether file chatflows array is zero
        if (newChatflows.length == 0) return

        // step 2 - check whether ids are duplicate in database
        let ids = '('
        let count: number = 0
        const lastCount = newChatflows.length - 1
        newChatflows.forEach((newChatflow) => {
            ids += `'${newChatflow.id}'`           //