A critical code injection vulnerability in Flowintel allows an authenticated attacker with high privileges to execute arbitrary Python code on the host system.

The application is vulnerable to CWE-94 (Code Injection) because it fails to validate configuration keys provided to the alerts settings update endpoint. These keys are directly incorporated into the application configuration file and subsequently reloaded via importlib.reload(), allowing an authenticated user with administrative privileges to inject and execute arbitrary Python statements.

This vulnerability poses a severe risk to the integrity and availability of the Flowintel platform. With a CVSS score of 8.6, the flaw allows for full compromise of the application environment, potentially leading to unauthorized data access, system disruption, or persistence mechanisms established by an attacker. Given the administrative access required, the primary concern is the escalation of impact from internal administrative actions to full system code execution.

Immediate Action: Review vendor security bulletins for the release of a patched version of Flowintel and apply the update immediately upon availability.

Proactive Monitoring: Monitor server logs for suspicious activity involving the alerts settings update endpoint, specifically looking for unusual characters or unexpected strings within configuration key parameters.

Compensating Controls: Restrict access to the administrative dashboard to only essential personnel using multi factor authentication and network level access controls to minimize the risk of unauthorized use of high privilege credentials.

Public Exploit Available: Unknown.

The severity of this code injection flaw necessitates immediate attention. While the attack requires administrative privileges, the ability to execute arbitrary code provides an attacker with complete control over the application logic. Security teams should prioritize patching as soon as the vendor provides a fix and strictly enforce the principle of least privilege for any accounts with administrative access to the Flowintel platform.