CVE-2024-12909

Executive Summary

CVE-2024-12909 is a critical SQL injection vulnerability (CVSS 10.0) affecting the run-llama/llama_index repository, specifically the FinanceChatLlamaPack component up to version v0.12.3. The flaw resides in the run_sql_query function of the database_agent, allowing an unauthenticated attacker to inject arbitrary SQL queries. This can be escalated to remote code execution (RCE) by leveraging PostgreSQL's large object functionality. The vulnerability is unpatched in the affected versions, with a fix available in version 0.3.0. Given the high impact and ease of exploitation, immediate action is required.

Supply Chain & Package Security

This vulnerability affects the llama_index Python package, which is distributed via PyPI. Organizations using this package in their supply chain should verify their dependency version and update to v0.3.0 or later. The lack of a public exploit or patch details increases the risk of targeted attacks.

CVSS Breakdown & Threat Level

• CVSS Score: 10.0 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

The maximum CVSS score reflects the ease of exploitation and the potential for full system compromise.

Deep Dive & Mechanics

The vulnerability exists in the run_sql_query function within the database_agent of the FinanceChatLlamaPack. This function is designed to execute SQL queries against a PostgreSQL database. However, it fails to sanitize user-supplied input, allowing an attacker to inject arbitrary SQL commands.

The attack vector involves crafting a malicious SQL query that, when executed, can:

1. Extract sensitive data via UNION or OR clauses.
2. Modify or delete data using INSERT, UPDATE, or DELETE statements.
3. Achieve remote code execution by exploiting PostgreSQL's large object functionality. This involves using functions like lo_import and lo_export to read/write files on the server, potentially leading to arbitrary code execution.

The vulnerability is triggered when the database_agent processes a user request without proper input validation or parameterized queries.

Vulnerable vs. Patched Code

Vulnerable Code (<= v0.12.3):

def run_sql_query(query: str):
    # Directly executes user input without sanitization
    cursor.execute(query)
    return cursor.fetchall()

Patched Code (v0.3.0):

def run_sql_query(query: str):
    # Uses parameterized queries to prevent injection
    cursor.execute("SELECT * FROM table WHERE id = %s", (query,))
    return cursor.fetchall()

The patched version uses parameterized queries, which separate SQL logic from data, effectively neutralizing injection attempts.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Deploy a vulnerable instance of llama_index v0.12.3 with PostgreSQL backend.
2. Ensure the FinanceChatLlamaPack is active and accessible via network.

Exploitation Steps:

1. Identify the vulnerable endpoint (e.g., /api/query).
2. Craft a malicious SQL injection payload:

   '; SELECT lo_import('/etc/passwd'); --
   

3. Send the payload to the endpoint:

   curl -X POST http://target/api/query -d '{"query": "'; SELECT lo_import('/etc/passwd'); --"}'
   

4. Use PostgreSQL large object functions to read/write files:

   '; SELECT lo_export(12345, '/tmp/evil.sh'); --
   

5. Execute arbitrary commands via PostgreSQL's COPY or pg_read_file functions.

Blue Team (Defensive)

Detection:

• Monitor for unusual SQL queries containing lo_import, lo_export, or COPY statements.
• Alert on queries with multiple statements (e.g., ; or UNION).
• Use WAF rules to block SQL injection patterns.

Mitigation:

• Immediately update to llama_index v0.3.0 or later.
• Implement input validation and parameterized queries in all database interactions.
• Restrict PostgreSQL user permissions to prevent use of large object functions.

Indicators of Compromise (IOCs)

• Network: Unusual SQL queries containing lo_import, lo_export, pg_read_file, or COPY.
• Logs: Database logs showing multiple SQL statements in a single query.
• Files: Unexpected large objects in PostgreSQL (check pg_largeobject table).
• Processes: Unusual system commands executed via PostgreSQL (e.g., bash, python).

Detection Engineering

YARA Rule

rule CVE_2024_12909_SQLi {
    meta:
        description = "Detects SQL injection attempts targeting llama_index FinanceChatLlamaPack"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-12909"
    strings:
        $s1 = "lo_import" ascii nocase
        $s2 = "lo_export" ascii nocase
        $s3 = "pg_read_file" ascii nocase
        $s4 = "COPY" ascii nocase
        $s5 = "UNION" ascii nocase
    condition:
        any of ($s1, $s2, $s3, $s4, $s5)
}

Sigma Rule

title: SQL Injection Attempt Against llama_index
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects SQL injection attempts targeting the run_sql_query function
author: Valters IT
logsource:
    category: application
    product: llama_index
detection:
    selection:
        query|contains:
            - "lo_import"
            - "lo_export"
            - "pg_read_file"
            - "COPY"
            - "UNION"
    condition: selection
falsepositives:
    - Legitimate use of large objects (rare)
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-12909 SQL Injection Attempt"; flow:to_server; content:"lo_import"; nocase; content:"lo_export"; nocase; content:"pg_read_file"; nocase; content:"COPY"; nocase; content:"UNION"; nocase; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Update llama_index to version 0.3.0 or later.
2. Short-term: If update is not possible, disable the FinanceChatLlamaPack or restrict access to the vulnerable endpoint.
3. Long-term: Implement parameterized queries in all database interactions. Conduct a code review for similar vulnerabilities.
4. Monitoring: Deploy the provided detection rules to identify exploitation attempts.

Valters IT
Securing Digital Frontiers