Hundreds of LLM Servers Expose Corporate, Health & Other Online Data

Hundreds of open source large language model (LLM) builder servers and dozens of vector databases are leaking highly sensitive information to the open Web.

As companies rush to integrate AI into their business workflows, they occasionally pay insufficient attention to how to secure these tools, and the information they trust them with. In a new report, Legit security researcher Naphtali Deutsch demonstrated as much by scanning the Web for two kinds of potentially vulnerable open source (OSS) AI services: vector databases — which store data for AI tools — and LLM application builders — specifically, the open source program Flowise. The investigation unearthed a bevy of sensitive personal and corporate data, unknowingly exposed by organizations stumbling to get in on the generative AI revolution.

"A lot of programmers see these tools on the Internet, then try to set them up in their environment," Deutsch says, but those same programmers are leaving security considerations behind.

Hundreds of Unpatched Flowise Servers

Flowise is a low-code tool for building all kinds of LLM applications. It's backed by Y Combinator, and sports tens of thousands of stars on GitHub.

Whether it be a customer support bot or a tool for generating and extracting data for downstream programming and other tasks, the programs that developers build with Flowise tend to access and manage large quantities of data. It's no wonder, then, that the majority of Flowise servers are password-protected.

Related:The New Frontiers of Cyber-Warfare: Insights From Black Hat 2024

A password, however, isn't security enough. Earlier this year, a researcher in India discovered an authentication bypass vulnerability in Flowise versions 1.6.2 and earlier, which can be triggered by simply capitalizing a few characters in the program's API endpoints. Tracked as CVE-2024-31621, the issue earned a "high" 7.6 score on the CVSS Version 3 scale.

By exploiting CVE-2024-31621, Legit's Deutsch cracked 438 Flowise servers. Inside were GitHub access tokens, OpenAI API keys, Flowise passwords and API keys in plaintext, configurations and prompts associated with Flowise apps, and more.

Continue Reading This Story on Dark Reading