YOU HAD ME AT “HELLO”: INSIDE THE GREETER, A CHINESE‑LANGUAGE FRAMEWORK TARGETING AI INFRASTRUCTURE

Summary from the TLDR InfoSec newsletter

Era researchers tracked a Chinese-language framework, Greeter, exploiting Flowise's overrideConfig code-injection flaw (CVE-2024-58351) across seven honeypots from July to October. Each “hello” request delivered a different command through javascriptFunction, without changing the saved chatflow. The framework ran host reconnaissance, searched .env files, SSH keys, and Flowise encryption keys, probed AWS, Azure, and Google Cloud metadata services, and checked Docker socket access, Linux capabilities, persistence paths, and memory-based execution. Of 3,277 identifiable internet-exposed Flowise instances, 703 lacked authentication. 46 matched the honeypot's vulnerable conditions.