Langflow IDOR: Unauthorized Access to Another User's Flow via /api/v1/responses

union isfuzzy=true
    AzureDiagnostics,
    AppServiceHTTPLogs
| where TimeGenerated >= ago(24h)
| where requestUri_s has "/api/v1/responses"
    or CsUriStem has "/api/v1/responses"
| extend UriStem = coalesce(requestUri_s, CsUriStem)
| extend StatusCode = coalesce(sc_status_d, ScStatus)
| extend CallerIP = coalesce(clientIP_s, CIp)
| extend UserAgent = coalesce(userAgent_s, CsUserAgent)
| where StatusCode == 200
| summarize
    RequestCount = count(),
    DistinctFlowIds = dcount(extract(@"responses/([^/?]+)", 1, UriStem)),
    FlowIdList = make_set(extract(@"responses/([^/?]+)", 1, UriStem), 100),
    FirstSeen = min(TimeGenerated),
    LastSeen = max(TimeGenerated)
    by CallerIP, UserAgent, bin(TimeGenerated, 10m)
| where DistinctFlowIds >= 5
| extend Severity = case(
    DistinctFlowIds >= 20, "Critical",
    DistinctFlowIds >= 10, "High",
    "Medium"
  )
| project FirstSeen, LastSeen, CallerIP, UserAgent, RequestCount, DistinctFlowIds, FlowIdList, Severity

index=web OR index=proxy OR index=app
(uri_path="/api/v1/responses*" OR url="*/api/v1/responses*")
status=200
| rex field=uri_path "/api/v1/responses/(?<flow_id>[^/?]+)"
| where isnotnull(flow_id) AND flow_id!=""
| bin _time span=10m
| stats
    count AS request_count
    dc(flow_id) AS distinct_flow_ids
    values(flow_id) AS flow_ids
    earliest(_time) AS first_seen
    latest(_time) AS last_seen
    by src_ip, http_user_agent, _time
| where distinct_flow_ids >= 5
| eval severity=case(
    distinct_flow_ids>=20, "critical",
    distinct_flow_ids>=10, "high",
    true(), "medium"
  )
| eval alert_title="Langflow IDOR: Enumeration of multiple flow IDs from single source"
| table first_seen, last_seen, src_ip, http_user_agent, request_count, distinct_flow_ids, flow_ids, severity, alert_title
| sort - distinct_flow_ids

sequence by source.ip with maxspan=10m
  [any where event.dataset == "http" and
   url.path like "/api/v1/responses/*" and
   http.response.status_code == 200] with runs=5

SELECT
  sourceip,
  "HTTP User-Agent" AS user_agent,
  COUNT(*) AS request_count,
  COUNT(DISTINCT REGEXP_EXTRACT(URL, '/api/v1/responses/([^/?]+)', 1)) AS distinct_flow_ids,
  MIN(starttime) AS first_seen,
  MAX(starttime) AS last_seen
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) IN ('Apache HTTP Server', 'Nginx', 'F5 BIG-IP LTM')
  AND URL ILIKE '%/api/v1/responses/%'
  AND responseCode = 200
  AND starttime >= (DATEADD('hour', -24, now()))
GROUP BY
  sourceip,
  "HTTP User-Agent",
  DATEADD('minute', -(MOD(MINUTE(starttime), 10)), starttime)
HAVING
  COUNT(DISTINCT REGEXP_EXTRACT(URL, '/api/v1/responses/([^/?]+)', 1)) >= 5
ORDER BY distinct_flow_ids DESC

_sourceCategory=web/access OR _sourceCategory=proxy/logs
| parse regex field=url "/api/v1/responses/(?<flow_id>[^/?\"]+)"
| where !isNull(flow_id)
| where status_code == "200" OR status == "200"
| timeslice 10m
| stats
    count as request_count,
    dcount(flow_id) as distinct_flow_ids,
    makelist(flow_id) as flow_id_list
    by src_ip, _timeslice, user_agent
| where distinct_flow_ids >= 5
| if(distinct_flow_ids >= 20, "critical", if(distinct_flow_ids >= 10, "high", "medium")) as severity
| sort by distinct_flow_ids desc

rule langflow_idor_responses_enumeration {
  meta:
    author = "df00tech detection engineering"
    description = "Detects IDOR enumeration against Langflow /api/v1/responses (CVE-2026-55255) - CISA KEV"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://github.com/advisories/GHSA-qrpv-q767-xqq2"

  events:
    $http.metadata.event_type = "NETWORK_HTTP"
    $http.network.http.method = "GET"
    re.regex($http.network.http.request_url, `/api/v1/responses/[^/?]+`) nocase
    $http.network.http.response_code = 200
    $src_ip = $http.principal.ip
    $flow_id = re.capture($http.network.http.request_url, `/api/v1/responses/([^/?]+)`)

  match:
    $src_ip over 10m

  condition:
    #flow_id >= 5
}

#event_simpleName=NetworkReceiveAccept OR #event_simpleName=NetworkConnectIP4
| LocalAddressIP4=* RemotePort=* HttpPath=/api/v1/responses/*
| HttpStatusCode=200
| rex field=HttpPath "/api/v1/responses/(?<flow_id>[^/?]+)"
| groupBy([RemoteAddressIP4, UserAgent], function=[
    count(aid, as=request_count),
    dc(flow_id, as=distinct_flow_ids),
    collect(flow_id, as=flow_ids, limit=50),
    min(timestamp, as=first_seen),
    max(timestamp, as=last_seen)
  ])
| distinct_flow_ids >= 5
| eval severity=if(distinct_flow_ids>=20, "critical", if(distinct_flow_ids>=10, "high", "medium"))
| sort(distinct_flow_ids, order=desc)