Detect CVE-2025-34291: Langflow Origin Validation Error Exploitation in CrowdStrike LogScale
Detects exploitation of CVE-2025-34291, an origin validation error (CWE-346) in Langflow that allows attackers to bypass origin checks. This vulnerability is actively exploited in the wild (CISA KEV) and may enable unauthorized access to Langflow API endpoints, flow execution, or administrative functions by bypassing cross-origin restrictions.
MITRE ATT&CK
LogScale Detection Query
#event_simpleName=NetworkReceiveAccept OR #event_simpleName=NetworkConnect
| timestamp := EventTime
| LocalAddressIP4 = LocalAddressIP4
| RemoteAddressIP4 = RemoteAddressIP4
| HttpPath in ("/api/v1/", "/api/v2/", "/flows", "/run", "/build")
| HttpMethod in ("POST", "PUT", "DELETE", "PATCH")
| HttpResponseCode in (200, 201, 202, 204)
| (HttpReferer = null() OR HttpReferer = "" OR HttpReferer = "null" OR NOT HttpReferer matches HostName)
| ProcessName = "python*" OR ProcessName = "uvicorn*" OR ProcessName = "gunicorn*"
| CommandLine matches "langflow*" OR CommandLine matches "*uvicorn app:*"
| eval OriginAnomaly = case(
HttpReferer = null(), "Missing Referer",
HttpReferer = "null", "Null Origin Bypass",
NOT HttpReferer matches HostName, "Cross-Origin Mismatch",
true(), "Legitimate"
)
| where OriginAnomaly != "Legitimate"
| groupBy([RemoteAddressIP4, HttpPath, OriginAnomaly], function=count(1, as=RequestCount))
| where RequestCount >= 3
| sort(RequestCount, order=desc)CrowdStrike Falcon LogScale/CQL query correlating network events and process context to identify Langflow processes receiving cross-origin bypass requests consistent with CVE-2025-34291 exploitation.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate Langflow API integrations using non-browser HTTP clients without Referer headers
- Development workstations running local Langflow instances accessed by automation scripts
- Container-based deployments where inter-service calls lack browser-standard headers
- API gateway configurations that normalize or remove Origin headers before forwarding
Other platforms for CVE-2025-34291
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1CVE-2025-34291 - Missing Origin Header Flow Execution
Expected signal: Web server access log entry with POST to /api/v1/run/FLOW_ID, empty Referer field, HTTP 200 response code, source IP of test machine
- Test 2CVE-2025-34291 - Null Origin Header Bypass Attempt
Expected signal: Web server log showing POST to /api/v1/flows with Origin: null and Referer: null headers, response code 200 or 201
- Test 3CVE-2025-34291 - Cross-Origin Mismatch API Access
Expected signal: Web server log entry with POST to /api/v1/build/ path, Origin and Referer headers showing external domain not matching Langflow host, response code 200-204
- Test 4CVE-2025-34291 - Automated Flow Enumeration Without Origin
Expected signal: Multiple GET requests to Langflow API endpoints within short timeframe from same source IP, all with empty Referer, varying response codes depending on authentication state
Response Playbook
Triage
- Identify the source IP(s) making requests with missing/null/mismatched Origin or Referer headers to Langflow API endpoints. Cross-reference with known IP reputation feeds and internal asset inventory to determine if the source is internal automation or an external threat actor.
- Determine which Langflow API endpoints were targeted. Endpoints such as /api/v1/run, /api/v1/build, and /flows indicate potential flow execution or exfiltration. Check if the requests succeeded (2xx responses) and what data or actions were triggered.
- Review Langflow application logs for the corresponding time window to identify authenticated vs. unauthenticated access, specific flows executed, any file reads/writes, or connections to external services initiated as a result of the flows being triggered.
- Verify the Langflow version deployed. If running < 1.9.3, the system is unpatched and vulnerable. Immediate escalation and containment are warranted even if exploitation intent is unclear.
Containment
- If active exploitation is confirmed or strongly suspected, immediately isolate the Langflow host or container from external network access by modifying firewall rules or security group policies to block inbound connections except from known-good management IPs.
- Implement an emergency WAF rule or reverse proxy configuration to enforce strict Origin header validation, rejecting requests where the Origin does not match the expected Langflow host, as an interim measure until the application is patched to v1.9.3 or later.
- Revoke or rotate any API keys, authentication tokens, or credentials that may have been exposed to or used within Langflow flows during the suspected exploitation window.
Evidence Collection
- Collect and preserve the full web server access logs (Nginx/Apache/IIS) for the affected Langflow instance covering at least 72 hours prior to detection, capturing all request URIs, source IPs, HTTP methods, response codes, and header values.
- Export Langflow application-level logs and any database records (flow definitions, execution history, component credentials) to determine what data was accessed, what flows were executed, and whether any custom components or scripts were injected.
Escalation Criteria
- !Escalate immediately to incident response if Langflow flows containing credentials, API keys, or connections to production systems (databases, cloud APIs, code repositories) were executed during the suspicious activity window.
- !Escalate if the attacking IP is associated with known threat actors, appears in threat intelligence feeds, or if the attack pattern shows signs of automated scanning followed by targeted exploitation, suggesting a coordinated campaign rather than opportunistic scanning.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Web server access logs showing POST/PUT/DELETE requests to /api/v1/ or /api/v2/ endpoints with absent, empty, or 'null' Referer/Origin headers and successful (2xx) response codes - >
Langflow application database or configuration files containing flow definitions that may have been read, modified, or executed by an unauthorized actor - >
Network flow records showing outbound connections initiated from the Langflow host to external IPs following the origin bypass requests, potentially indicating data exfiltration or C2 callback via executed flows
Tuning Guidance
Start by filtering to confirmed Langflow hostnames or IP addresses to reduce noise from unrelated web applications. Raise the request count threshold (currently 3) if your environment has legitimate API clients that intermittently omit Referer headers — consider increasing to 10+ for high-volume environments. Add known-good internal IP ranges (CI/CD servers, monitoring systems, developer workstations) to an allowlist to reduce false positives. For environments where Langflow is deployed internally only, any external source IP in these queries should be treated as critical severity. Consider correlating with Langflow application-level logs to confirm flow execution occurred, not just API endpoint access.
Hunting Queries
Threat hunt for persistent or recurring origin bypass attempts against Langflow over the past 7 days, identifying source IPs with repeated access patterns that may indicate sustained exploitation or reconnaissance activity.
W3CIISLog
| where TimeGenerated >= ago(7d)
| where csUriStem has_any ("/api/v1/", "/api/v2/", "/flows", "/run", "/build")
| where csMethod in ("POST", "PUT", "DELETE", "PATCH")
| where isempty(csRefererHeader) or csRefererHeader == "null"
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), RequestCount=count(), Endpoints=make_set(csUriStem) by csClientIP, csUserAgent
| extend DaySpan = datetime_diff('day', LastSeen, FirstSeen)
| where DaySpan >= 1 or RequestCount >= 10
| order by RequestCount descindex=web earliest=-7d
| search uri_path IN ("/api/v1/*", "/api/v2/*", "/flows*", "/run*", "/build*")
| where http_method IN ("POST","PUT","DELETE","PATCH")
| where isnull(http_referer) OR http_referer="" OR http_referer="null"
| stats count AS requests, dc(uri_path) AS unique_endpoints, min(_time) AS first_seen, max(_time) AS last_seen BY src_ip, http_user_agent
| eval duration_hours=round((last_seen-first_seen)/3600,1)
| where requests>=10 OR duration_hours>=24
| sort -requestsAtomic Red Team Tests
Simulates an attacker sending a POST request to the Langflow run endpoint without an Origin or Referer header to test origin validation bypass. This represents the simplest exploitation pattern for CVE-2025-34291.
Command
curl -s -X POST http://LANGFLOW_HOST:7860/api/v1/run/FLOW_ID \
-H 'Content-Type: application/json' \
--no-referer \
-d '{"input_value": "test", "input_type": "chat", "output_type": "chat"}' \
-w '\nHTTP Status: %{http_code}\n'Cleanup
No persistent changes; the flow execution result is ephemeral. Review Langflow execution logs to confirm the test was recorded.Expected Telemetry
Web server access log entry with POST to /api/v1/run/FLOW_ID, empty Referer field, HTTP 200 response code, source IP of test machine
Expected Detection
Alert fires on the KQL/SPL/EQL queries due to successful POST request to Langflow API path with missing Referer header
Tests origin validation by sending a request with the Origin header explicitly set to 'null', a known bypass technique where some implementations incorrectly validate the literal string 'null' as a permitted origin.
Command
curl -s -X POST http://LANGFLOW_HOST:7860/api/v1/flows \
-H 'Content-Type: application/json' \
-H 'Origin: null' \
-H 'Referer: null' \
-d '{"name": "test-flow", "description": "atomic test", "data": {}}' \
-w '\nHTTP Status: %{http_code}\n'Cleanup
Delete any test flow created: curl -X DELETE http://LANGFLOW_HOST:7860/api/v1/flows/CREATED_FLOW_IDExpected Telemetry
Web server log showing POST to /api/v1/flows with Origin: null and Referer: null headers, response code 200 or 201
Expected Detection
Detection rule triggers on 'Null Origin Bypass' classification due to Origin/Referer value being the string 'null'
Simulates a cross-origin request where the attacker's domain is used as the Referer/Origin, bypassing naive same-origin checks if the application fails to properly validate the origin against the expected host.
Command
curl -s -X POST http://LANGFLOW_HOST:7860/api/v1/build/FLOW_ID/flow \
-H 'Content-Type: application/json' \
-H 'Origin: http://attacker-controlled-domain.example.com' \
-H 'Referer: http://attacker-controlled-domain.example.com/exploit' \
-d '{"data": {}}' \
-w '\nHTTP Status: %{http_code}\n'Cleanup
No persistent state changes expected from a build endpoint probe. Verify in Langflow logs that no flow was permanently modified.Expected Telemetry
Web server log entry with POST to /api/v1/build/ path, Origin and Referer headers showing external domain not matching Langflow host, response code 200-204
Expected Detection
Detection rule triggers on 'Cross-Origin Mismatch' classification where Referer domain does not match the destination host of the Langflow instance
Simulates an attacker enumerating available Langflow flows via the API without proper Origin headers, which may be a precursor step before targeting specific high-value flows for execution.
Command
for endpoint in /api/v1/flows /api/v1/flows?page_size=100 /api/v1/components /api/v1/variables; do
echo "Testing: $endpoint"
curl -s -X GET http://LANGFLOW_HOST:7860$endpoint \
--no-referer \
-H 'Accept: application/json' \
-w 'Status: %{http_code}\n' | python3 -m json.tool --no-ensure-ascii 2>/dev/null | head -20
sleep 1
doneCleanup
No modifications made — read-only enumeration. Flush any authentication tokens or session data used during testing.Expected Telemetry
Multiple GET requests to Langflow API endpoints within short timeframe from same source IP, all with empty Referer, varying response codes depending on authentication state
Expected Detection
May trigger on volume-based thresholds; primary detection value is in establishing reconnaissance baseline before write-operation exploitation detected by other atomic tests