Era discloses the Greeter attack framework targeting Flowise
Understand this story
The Era research team has disclosed a Chinese-language attack framework called Greeter that exploits CVE-2024-58351 to inject javascriptFunction into the overrideConfig of the Flowise prediction API, thereby achieving remote code execution without authentication. From July to October 2026, the team recorded the framework sending messages continuously at intervals of about 3.5 seconds and delivering malicious commands on 7 Flowise 1.8.2 honeypots across 4 regions. These honeypots were intentionally configured without FLOWISE_USERNAME and FLOWISE_PASSWORD. Era states that the honeypots returned fabricated cloud credentials; as for follow-on effects such as credential theft, these depend on the permissions and trust relationships actually present in the environment and are not an inevitable consequence of compromising Flowise. Era also clarifies that the exposure figures it provides are version-based estimates and do not represent successful exploitation or intrusion that has occurred.
AI overview based on source reports · Updated 2 hr ago
Coverage timeline
Follow the coverage to explore different perspectives.
- Hacker News AIYou Had Me at "Hello": A Chinese‑Language Framework Targeting AI Infrastructure
Era researchers observed a Chinese-language exploitation framework they named Greeter attacking seven Flowise honeypots across four regions from July to October 2026, using the overrideConfig code injection flaw CVE-2024-58351 to execute commands via chat messages that each read only "hello". The 12-step chain included host reconnaissance, cloud metadata probing, credential discovery, persistence attempts and fileless execution staging, with commands arriving 3.5 seconds apart. A Shodan query found 4,372 internet-exposed Flowise instances, of which 703 of 3,277 version-identifiable hosts had no authentication enabled and 46 appeared to share the vulnerable conditions recreated in the honeypots.
Activity for this story
Not enough continuous observations to show a trend yet.