CVE-2025-34291 Google Chronicle · YARA-L

Detect CVE-2025-34291: Langflow Origin Validation Error Exploitation in Google Chronicle

Detects exploitation of CVE-2025-34291, an origin validation error (CWE-346) in Langflow that allows attackers to bypass origin checks. This vulnerability is actively exploited in the wild (CISA KEV) and may enable unauthorized access to Langflow API endpoints, flow execution, or administrative functions by bypassing cross-origin restrictions.

MITRE ATT&CK

Tactic
Initial Access Privilege Escalation Lateral Movement

YARA-L Detection Query

Google Chronicle (YARA-L)
yaral 
rule cve_2025_34291_langflow_origin_bypass {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects CVE-2025-34291 Langflow origin validation error exploitation"
    severity = "HIGH"
    priority = "HIGH"
    reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-34291"

  events:
    $req.metadata.event_type = "NETWORK_HTTP"
    $req.principal.ip = $src_ip
    $req.target.url =~ `.*/(api/v1|api/v2|flows|run|build).*`
    $req.network.http.method in {"POST", "PUT", "DELETE", "PATCH"}
    $req.network.http.response_code in {200, 201, 202, 204}
    (
      not $req.network.http.referral_url != ""
      or $req.network.http.referral_url = "null"
    )

  match:
    $src_ip over 5m

  condition:
    #req >= 3
}
high severity medium confidence

Chronicle YARA-L rule detecting repeated mutating HTTP requests to Langflow API endpoints with absent or null Referer headers, indicative of CVE-2025-34291 origin validation bypass exploitation.

Data Sources

Chronicle UDM HTTP EventsWeb ProxyNetwork Telemetry

Required Tables

network_http

False Positives & Tuning

  • Automated Langflow API clients operating without browser-originated requests
  • Internal service mesh traffic where headers are stripped by infrastructure components
  • Security scanners performing authenticated API enumeration during authorized assessments
  • CI/CD pipelines executing Langflow flows as part of ML model deployment processes

Other platforms for CVE-2025-34291

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1CVE-2025-34291 - Missing Origin Header Flow Execution

    Expected signal: Web server access log entry with POST to /api/v1/run/FLOW_ID, empty Referer field, HTTP 200 response code, source IP of test machine

  2. Test 2CVE-2025-34291 - Null Origin Header Bypass Attempt

    Expected signal: Web server log showing POST to /api/v1/flows with Origin: null and Referer: null headers, response code 200 or 201

  3. Test 3CVE-2025-34291 - Cross-Origin Mismatch API Access

    Expected signal: Web server log entry with POST to /api/v1/build/ path, Origin and Referer headers showing external domain not matching Langflow host, response code 200-204

  4. Test 4CVE-2025-34291 - Automated Flow Enumeration Without Origin

    Expected signal: Multiple GET requests to Langflow API endpoints within short timeframe from same source IP, all with empty Referer, varying response codes depending on authentication state

Last updated: 2026-06-19 Research depth: standard
References (4)

Response Playbook

Triage

  1. Identify the source IP(s) making requests with missing/null/mismatched Origin or Referer headers to Langflow API endpoints. Cross-reference with known IP reputation feeds and internal asset inventory to determine if the source is internal automation or an external threat actor.
  2. Determine which Langflow API endpoints were targeted. Endpoints such as /api/v1/run, /api/v1/build, and /flows indicate potential flow execution or exfiltration. Check if the requests succeeded (2xx responses) and what data or actions were triggered.
  3. Review Langflow application logs for the corresponding time window to identify authenticated vs. unauthenticated access, specific flows executed, any file reads/writes, or connections to external services initiated as a result of the flows being triggered.
  4. Verify the Langflow version deployed. If running < 1.9.3, the system is unpatched and vulnerable. Immediate escalation and containment are warranted even if exploitation intent is unclear.

Containment

  1. If active exploitation is confirmed or strongly suspected, immediately isolate the Langflow host or container from external network access by modifying firewall rules or security group policies to block inbound connections except from known-good management IPs.
  2. Implement an emergency WAF rule or reverse proxy configuration to enforce strict Origin header validation, rejecting requests where the Origin does not match the expected Langflow host, as an interim measure until the application is patched to v1.9.3 or later.
  3. Revoke or rotate any API keys, authentication tokens, or credentials that may have been exposed to or used within Langflow flows during the suspected exploitation window.

Evidence Collection

  1. Collect and preserve the full web server access logs (Nginx/Apache/IIS) for the affected Langflow instance covering at least 72 hours prior to detection, capturing all request URIs, source IPs, HTTP methods, response codes, and header values.
  2. Export Langflow application-level logs and any database records (flow definitions, execution history, component credentials) to determine what data was accessed, what flows were executed, and whether any custom components or scripts were injected.

Escalation Criteria

  • !Escalate immediately to incident response if Langflow flows containing credentials, API keys, or connections to production systems (databases, cloud APIs, code repositories) were executed during the suspicious activity window.
  • !Escalate if the attacking IP is associated with known threat actors, appears in threat intelligence feeds, or if the attack pattern shows signs of automated scanning followed by targeted exploitation, suggesting a coordinated campaign rather than opportunistic scanning.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >Web server access logs showing POST/PUT/DELETE requests to /api/v1/ or /api/v2/ endpoints with absent, empty, or 'null' Referer/Origin headers and successful (2xx) response codes
  • >Langflow application database or configuration files containing flow definitions that may have been read, modified, or executed by an unauthorized actor
  • >Network flow records showing outbound connections initiated from the Langflow host to external IPs following the origin bypass requests, potentially indicating data exfiltration or C2 callback via executed flows

Tuning Guidance

Start by filtering to confirmed Langflow hostnames or IP addresses to reduce noise from unrelated web applications. Raise the request count threshold (currently 3) if your environment has legitimate API clients that intermittently omit Referer headers — consider increasing to 10+ for high-volume environments. Add known-good internal IP ranges (CI/CD servers, monitoring systems, developer workstations) to an allowlist to reduce false positives. For environments where Langflow is deployed internally only, any external source IP in these queries should be treated as critical severity. Consider correlating with Langflow application-level logs to confirm flow execution occurred, not just API endpoint access.

Hunting Queries

Threat hunt for persistent or recurring origin bypass attempts against Langflow over the past 7 days, identifying source IPs with repeated access patterns that may indicate sustained exploitation or reconnaissance activity.

Hunting — KQL
kql 
W3CIISLog
| where TimeGenerated >= ago(7d)
| where csUriStem has_any ("/api/v1/", "/api/v2/", "/flows", "/run", "/build")
| where csMethod in ("POST", "PUT", "DELETE", "PATCH")
| where isempty(csRefererHeader) or csRefererHeader == "null"
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), RequestCount=count(), Endpoints=make_set(csUriStem) by csClientIP, csUserAgent
| extend DaySpan = datetime_diff('day', LastSeen, FirstSeen)
| where DaySpan >= 1 or RequestCount >= 10
| order by RequestCount desc
Hunting — SPL
spl 
index=web earliest=-7d
| search uri_path IN ("/api/v1/*", "/api/v2/*", "/flows*", "/run*", "/build*")
| where http_method IN ("POST","PUT","DELETE","PATCH")
| where isnull(http_referer) OR http_referer="" OR http_referer="null"
| stats count AS requests, dc(uri_path) AS unique_endpoints, min(_time) AS first_seen, max(_time) AS last_seen BY src_ip, http_user_agent
| eval duration_hours=round((last_seen-first_seen)/3600,1)
| where requests>=10 OR duration_hours>=24
| sort -requests

Atomic Red Team Tests

Test 1 CVE-2025-34291 - Missing Origin Header Flow Execution
linux

Simulates an attacker sending a POST request to the Langflow run endpoint without an Origin or Referer header to test origin validation bypass. This represents the simplest exploitation pattern for CVE-2025-34291.

Command

bash 
curl -s -X POST http://LANGFLOW_HOST:7860/api/v1/run/FLOW_ID \
  -H 'Content-Type: application/json' \
  --no-referer \
  -d '{"input_value": "test", "input_type": "chat", "output_type": "chat"}' \
  -w '\nHTTP Status: %{http_code}\n'

Cleanup

bash 
No persistent changes; the flow execution result is ephemeral. Review Langflow execution logs to confirm the test was recorded.

Expected Telemetry

Web server access log entry with POST to /api/v1/run/FLOW_ID, empty Referer field, HTTP 200 response code, source IP of test machine

Expected Detection

Alert fires on the KQL/SPL/EQL queries due to successful POST request to Langflow API path with missing Referer header

Test 2 CVE-2025-34291 - Null Origin Header Bypass Attempt
linux

Tests origin validation by sending a request with the Origin header explicitly set to 'null', a known bypass technique where some implementations incorrectly validate the literal string 'null' as a permitted origin.

Command

bash 
curl -s -X POST http://LANGFLOW_HOST:7860/api/v1/flows \
  -H 'Content-Type: application/json' \
  -H 'Origin: null' \
  -H 'Referer: null' \
  -d '{"name": "test-flow", "description": "atomic test", "data": {}}' \
  -w '\nHTTP Status: %{http_code}\n'

Cleanup

bash 
Delete any test flow created: curl -X DELETE http://LANGFLOW_HOST:7860/api/v1/flows/CREATED_FLOW_ID

Expected Telemetry

Web server log showing POST to /api/v1/flows with Origin: null and Referer: null headers, response code 200 or 201

Expected Detection

Detection rule triggers on 'Null Origin Bypass' classification due to Origin/Referer value being the string 'null'

Test 3 CVE-2025-34291 - Cross-Origin Mismatch API Access
linux

Simulates a cross-origin request where the attacker's domain is used as the Referer/Origin, bypassing naive same-origin checks if the application fails to properly validate the origin against the expected host.

Command

bash 
curl -s -X POST http://LANGFLOW_HOST:7860/api/v1/build/FLOW_ID/flow \
  -H 'Content-Type: application/json' \
  -H 'Origin: http://attacker-controlled-domain.example.com' \
  -H 'Referer: http://attacker-controlled-domain.example.com/exploit' \
  -d '{"data": {}}' \
  -w '\nHTTP Status: %{http_code}\n'

Cleanup

bash 
No persistent state changes expected from a build endpoint probe. Verify in Langflow logs that no flow was permanently modified.

Expected Telemetry

Web server log entry with POST to /api/v1/build/ path, Origin and Referer headers showing external domain not matching Langflow host, response code 200-204

Expected Detection

Detection rule triggers on 'Cross-Origin Mismatch' classification where Referer domain does not match the destination host of the Langflow instance

Test 4 CVE-2025-34291 - Automated Flow Enumeration Without Origin
linux

Simulates an attacker enumerating available Langflow flows via the API without proper Origin headers, which may be a precursor step before targeting specific high-value flows for execution.

Command

bash 
for endpoint in /api/v1/flows /api/v1/flows?page_size=100 /api/v1/components /api/v1/variables; do
  echo "Testing: $endpoint"
  curl -s -X GET http://LANGFLOW_HOST:7860$endpoint \
    --no-referer \
    -H 'Accept: application/json' \
    -w 'Status: %{http_code}\n' | python3 -m json.tool --no-ensure-ascii 2>/dev/null | head -20
  sleep 1
done

Cleanup

bash 
No modifications made — read-only enumeration. Flush any authentication tokens or session data used during testing.

Expected Telemetry

Multiple GET requests to Langflow API endpoints within short timeframe from same source IP, all with empty Referer, varying response codes depending on authentication state

Expected Detection

May trigger on volume-based thresholds; primary detection value is in establishing reconnaissance baseline before write-operation exploitation detected by other atomic tests

Related Detections

Tactic Hubs

TA0001Initial AccessTA0004Privilege EscalationTA0008Lateral Movement

Related Techniques

T1190Exploit Public-Facing ApplicationT1059Command and Scripting InterpreterT1552Unsecured Credentials

Same Tactic: Initial Access

Popular Detections