CVE-2024-12911

Executive Summary

CVE-2024-12911 is a critical SQL injection vulnerability found in the default_jsonalyzer function of the JSONalyzeQueryEngine within the run-llama/llama_index library. This flaw allows an attacker to inject arbitrary SQL commands through prompt injection, leading to unauthorized file creation and Denial-of-Service (DoS) attacks. The vulnerability affects all versions prior to 0.5.1. The CVSS score is 7.1 (High), and the EPSS probability is 0.0%, indicating low exploitation likelihood at this time. No public proof-of-concept (PoC) or exploit code has been released.

Supply Chain & Package Security

This vulnerability resides in the PyPI package llama-index. Users of this package should immediately update to version 0.5.1 or later. The package is widely used in AI/ML pipelines for data indexing and querying, making it a high-value target for supply chain attacks. Organizations should verify their dependency trees and ensure no outdated versions are in use.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Impact confined to the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited data modification.
• Availability (A): Low (L) – Limited service disruption.

Threat Level: High. The low complexity and network attack vector make this vulnerability attractive to attackers, despite the low EPSS score.

Deep Dive & Mechanics

The JSONalyzeQueryEngine is designed to parse and analyze JSON data using SQL-like queries. The default_jsonalyzer function constructs SQL queries by concatenating user-supplied input without proper sanitization. An attacker can craft a malicious JSON payload that, when processed, injects SQL commands into the underlying database query.

Attack Flow:

1. The attacker sends a crafted JSON payload to the JSONalyzeQueryEngine.
2. The default_jsonalyzer function extracts user input from the JSON and embeds it directly into an SQL query.
3. The injected SQL commands execute, allowing the attacker to create arbitrary files on the server or cause a denial of service by corrupting the database.

Example Injection:

{
  "query": "SELECT * FROM users; DROP TABLE logs; --"
}

This input would result in the execution of DROP TABLE logs, leading to data loss and DoS.

Vulnerable vs. Patched Code

Vulnerable Code (pre-0.5.1):

def default_jsonalyzer(self, json_data, query):
    sql_query = f"SELECT {query} FROM json_data"
    # No sanitization of 'query' parameter
    return self.db.execute(sql_query)

Patched Code (0.5.1):

def default_jsonalyzer(self, json_data, query):
    # Sanitize input using parameterized queries
    safe_query = sanitize_sql_input(query)
    sql_query = "SELECT " + safe_query + " FROM json_data"
    return self.db.execute(sql_query, (json_data,))

The patch introduces input sanitization and parameterized queries to prevent SQL injection.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Install vulnerable version: pip install llama-index==0.5.0
2. Set up a test environment with a SQLite database.
3. Run a simple application using JSONalyzeQueryEngine.

Exploitation Steps:

1. Craft a malicious JSON payload:

   {
     "query": "1; CREATE TABLE pwned (data TEXT); --"
   }
   

2. Send the payload to the vulnerable endpoint.
3. Verify file creation or DoS by checking the database.

Note: No public exploit code is available. The above is a conceptual example.

Blue Team

Detection:

• Monitor for unusual SQL queries in logs.
• Use WAF rules to block suspicious JSON payloads containing SQL keywords.
• Implement input validation on all JSON fields.

Hunting:

• Search for JSONalyzeQueryEngine usage in codebases.
• Check for any CREATE TABLE or DROP TABLE statements in database logs.

Indicators of Compromise (IOCs)

• Network: Unusual SQL commands in HTTP request bodies (e.g., DROP, CREATE, INSERT).
• File System: Unexpected files created in the application directory (e.g., /tmp/exploit.txt).
• Database: New tables or corrupted data in the application database.
• Logs: SQL errors or warnings indicating injection attempts.

Detection Engineering

YARA Rule

rule CVE_2024_12911_SQLi {
    meta:
        description = "Detects SQL injection attempts targeting JSONalyzeQueryEngine"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-12911"
    strings:
        $sql_keyword = /(DROP|CREATE|INSERT|DELETE|UPDATE|ALTER|EXEC|UNION|SELECT)\s/i
        $json_pattern = /"query"\s*:\s*"[^"]*"/i
    condition:
        $json_pattern and any of ($sql_keyword)
}

Sigma Rule

title: SQL Injection via JSONalyzeQueryEngine
id: cve-2024-12911
status: experimental
description: Detects SQL injection attempts in JSON payloads targeting llama_index
author: Valters IT
logsource:
    category: webserver
    product: generic
detection:
    selection:
        http.method: POST
        http.body|contains: 
            - "DROP "
            - "CREATE "
            - "INSERT "
            - "DELETE "
            - "UNION "
    condition: selection
falsepositives:
    - Legitimate use of SQL keywords in JSON
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-12911 SQL Injection Attempt"; flow:to_server; content:"POST"; http_method; content:"\"query\""; http_client_body; pcre:"/(DROP|CREATE|INSERT|DELETE|UPDATE|ALTER|EXEC|UNION|SELECT)\s/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade to llama-index version 0.5.1 or later.
2. Workaround: If upgrade is not possible, implement strict input validation on all JSON fields processed by JSONalyzeQueryEngine.
3. Network: Deploy WAF rules to block SQL keywords in JSON payloads.
4. Monitoring: Enable detailed logging of database queries and monitor for anomalies.
5. Training: Educate developers on secure coding practices, especially parameterized queries.

Valters IT