CVE-2024-10131

Executive Summary

CVE-2024-10131 is a critical Remote Code Execution (RCE) vulnerability in Infiniflow RAGFlow version 0.11.0, specifically within the add_llm function in llm_app.py. The vulnerability arises from the unsafe dynamic instantiation of classes using user-supplied input (req['llm_factory'] and req['llm_name']) without proper validation or sanitization. An attacker can supply a malicious llm_factory value that, when used as an index to model dictionaries, leads to arbitrary code execution. With a CVSS score of 8.8, this vulnerability poses a severe threat to confidentiality, integrity, and availability. No public exploit code or patch is currently available, and the EPSS score is 0.0%, indicating low exploitation activity at this time.

Supply Chain & Package Security

This vulnerability affects the Python-based RAGFlow application, which is distributed via PyPI and GitHub. The insecure use of dynamic class instantiation in llm_app.py introduces a supply chain risk, as any user or system integrating RAGFlow could be compromised if an attacker controls the llm_factory parameter. Organizations using RAGFlow should treat this as a critical supply chain security issue and monitor for updates from Infiniflow.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required for exploitation.
• Privileges Required (PR): None (N) – No authentication is needed.
• User Interaction (UI): None (N) – No user action is required.
• Scope (S): Unchanged (U) – The impact is confined to the vulnerable component.
• Confidentiality (C): High (H) – Full disclosure of sensitive data is possible.
• Integrity (I): High (H) – Complete compromise of data integrity is possible.
• Availability (A): High (H) – Full denial of service or system takeover is possible.

Threat Level: Critical. The combination of network exploitability, low complexity, and high impact makes this a top-priority vulnerability for patching and monitoring.

Deep Dive & Mechanics

The vulnerability is located in the add_llm function within llm_app.py. The function accepts a JSON request containing llm_factory and llm_name parameters. It then uses these values to dynamically instantiate classes from model dictionaries (e.g., LLMFACTORY, LLMNAME). The code likely does something like:

def add_llm(req):
    factory = req['llm_factory']
    name = req['llm_name']
    # Unsafe dynamic instantiation
    model_class = LLMFACTORY[factory][name]
    instance = model_class()

An attacker can provide a malicious llm_factory value that, when used as an index, triggers the execution of arbitrary code. For example, if LLMFACTORY is a dictionary that maps strings to classes, an attacker could inject a string that causes Python to import and execute arbitrary modules or call dangerous functions. This is a classic example of insecure deserialization or dynamic code execution.

The lack of input validation allows an attacker to potentially:

• Execute system commands via os.system or subprocess.
• Import and instantiate arbitrary Python classes.
• Access or modify sensitive data.
• Achieve full remote code execution on the server.

Vulnerable vs. Patched Code

Vulnerable Code (RAGFlow 0.11.0):

def add_llm(req):
    factory = req['llm_factory']
    name = req['llm_name']
    # Unsafe: no validation of factory or name
    model_class = LLMFACTORY[factory][name]
    instance = model_class()
    # ... rest of function

Patched Code (Hypothetical):

def add_llm(req):
    factory = req.get('llm_factory', '')
    name = req.get('llm_name', '')
    # Validate against a whitelist of allowed factories and names
    allowed_factories = ['openai', 'anthropic', 'cohere']
    allowed_names = ['gpt-4', 'claude-3', 'command-r']
    if factory not in allowed_factories or name not in allowed_names:
        raise ValueError("Invalid LLM factory or name")
    model_class = LLMFACTORY[factory][name]
    instance = model_class()
    # ... rest of function

The patched version introduces strict whitelist validation to ensure only expected values are used, preventing arbitrary code execution.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A target running RAGFlow 0.11.0 with the add_llm endpoint exposed.
• Network access to the API endpoint (e.g., http://target:9380/api/v1/llm/add).

Exploitation Steps:

1. Identify the endpoint: The add_llm function is typically exposed via a REST API. Use a tool like curl or Burp Suite to interact with it.

2. Craft a malicious payload: Since no public exploit exists, a proof-of-concept payload could attempt to execute a system command. For example, if the code uses eval or exec internally, an attacker might inject Python code. A generic payload might look like:

{
  "llm_factory": "__import__('os').system('id')",
  "llm_name": "test"
}

However, the exact injection point depends on how LLMFACTORY is implemented. An attacker would need to reverse-engineer the code to find the exact injection vector.

3. Send the request:

curl -X POST http://target:9380/api/v1/llm/add \
  -H "Content-Type: application/json" \
  -d '{"llm_factory": "__import__('os').system('id')", "llm_name": "test"}'

4. Verify execution: Check for command output in the response or server logs.

Note: This is a hypothetical exploit. Actual exploitation may require more sophisticated techniques.

Blue Team

Detection and Response:

1. Monitor API logs: Look for unusual llm_factory or llm_name values, especially those containing special characters, import statements, or system commands.

2. Network monitoring: Detect outbound connections from the RAGFlow server that are unexpected (e.g., reverse shells).

3. File integrity monitoring: Watch for changes to critical system files or the RAGFlow installation directory.

4. Honeypot: Deploy a decoy RAGFlow instance to capture attacker behavior.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /api/v1/llm/add with unusual JSON payloads.
  • Outbound connections to unknown IPs on non-standard ports (e.g., 4444 for reverse shells).
• File IOCs:
  • Unexpected files in /tmp or /var/tmp (e.g., exploit.py, shell.sh).
  • Modified llm_app.py or other Python files in the RAGFlow directory.
• Process IOCs:
  • Unusual child processes spawned by the RAGFlow server (e.g., bash, nc, python).
• Log IOCs:
  • Error logs containing __import__, os.system, or subprocess calls.

Detection Engineering

YARA Rule

rule CVE_2024_10131_RAGFlow_RCE {
    meta:
        description = "Detects malicious payloads targeting CVE-2024-10131 in RAGFlow"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-10131"
    strings:
        $payload1 = "__import__" ascii wide nocase
        $payload2 = "os.system" ascii wide nocase
        $payload3 = "subprocess" ascii wide nocase
        $payload4 = "eval(" ascii wide nocase
        $payload5 = "exec(" ascii wide nocase
    condition:
        any of ($payload*) and filesize < 10KB
}

Sigma Rule

title: CVE-2024-10131 RAGFlow RCE Detection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP POST requests to RAGFlow's add_llm endpoint with suspicious payloads
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/api/v1/llm/add'
        cs-uri-query|contains: 
            - '__import__'
            - 'os.system'
            - 'subprocess'
            - 'eval('
            - 'exec('
    condition: selection
falsepositives:
    - Legitimate use of dynamic LLM names (unlikely)
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-10131 RAGFlow RCE Attempt"; flow:to_server; content:"POST"; http_method; content:"/api/v1/llm/add"; http_uri; content:"__import__"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Actions:

   • Disable the add_llm endpoint if not required.
   • Restrict network access to the RAGFlow API to trusted IPs only.
   • Implement a Web Application Firewall (WAF) rule to block suspicious payloads.

2. Long-term Fix:

   • Apply input validation and whitelist allowed llm_factory and llm_name values.
   • Avoid dynamic class instantiation based on user input.
   • Use a safe mapping or configuration file instead of direct dictionary indexing.

3. Monitoring:

   • Enable detailed logging for all API requests.
   • Set up alerts for anomalous llm_factory values.

4. Patch Management:

   • Monitor Infiniflow's GitHub repository for official patches.
   • Consider forking the project and applying a custom fix if no patch is released.

Valters IT
Securing Digital Frontiers