CVE-2024-3271

Executive Summary

CVE-2024-3271 is a critical command injection vulnerability in the run-llama/llama_index Python library, specifically within the safe_eval function. The vulnerability allows an attacker to bypass a security mechanism that checks for underscores in LLM-generated code, enabling arbitrary OS command execution. With a CVSS score of 9.8, this flaw poses a severe risk to any server hosting the application, potentially leading to full remote code execution (RCE). No public exploit or patch details are currently available, but the EPSS score of 0.0% suggests low active exploitation in the wild.

Supply Chain & Package Security

This vulnerability affects the PyPI package llama-index. Organizations using this package should immediately assess their dependency versions and monitor for updates. The lack of a patch status indicates a critical supply chain risk, as the vulnerable function may be widely deployed in AI/LLM applications.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Vulnerability does not affect other components.
• Confidentiality (C): High (H) – Full data access possible.
• Integrity (I): High (H) – Full system modification possible.
• Availability (A): High (H) – Full system disruption possible.

Threat Level: Critical – Immediate action required.

Deep Dive & Mechanics

The vulnerability resides in the safe_eval function within llama_index. This function is designed to safely evaluate code generated by a Large Language Model (LLM) by checking for underscores (_) in the code string. The underscore check is intended to prevent access to dangerous functions like __import__ or os.system. However, an attacker can craft input that does not contain an underscore but still executes OS commands. For example, using alternative methods such as exec() or eval() with string concatenation or base64-encoded payloads can bypass the underscore filter.

The core issue is that the security mechanism relies on a simple string check rather than proper sandboxing or AST-based analysis. This allows an attacker to inject arbitrary Python code that, when evaluated, executes system commands.

Vulnerable vs. Patched Code

Vulnerable Code (simplified):

def safe_eval(code: str):
    if "_" in code:
        raise ValueError("Underscores not allowed")
    return eval(code)

Patched Code (hypothetical):

import ast
def safe_eval(code: str):
    try:
        tree = ast.parse(code, mode='eval')
        for node in ast.walk(tree):
            if isinstance(node, ast.Call) and isinstance(node.func, ast.Attribute):
                if node.func.attr in ['__import__', 'system', 'popen']:
                    raise ValueError("Dangerous function call")
        return eval(compile(tree, '<string>', 'eval'))
    except Exception as e:
        raise ValueError(f"Evaluation failed: {e}")

The patched version uses AST parsing to detect dangerous function calls rather than relying on a simple string check.

Exploitation & Lab Setup

Red Team (Attacker)

Lab Setup:

1. Deploy a vulnerable instance of llama_index (e.g., version 0.9.0) on a local server.
2. Identify an endpoint that uses safe_eval (e.g., a custom query function).

Exploit Payload:

# Bypass underscore check using exec with base64
import base64
payload = base64.b64encode(b"import os; os.system('id')").decode()
code = f"exec(base64.b64decode('{payload}'))"
# Send code to vulnerable endpoint

Execution Steps:

1. Send the crafted code to the vulnerable endpoint.
2. Observe the output of the id command on the server.

Blue Team (Defender)

Detection:

• Monitor for unusual eval() or exec() calls in application logs.
• Look for base64-encoded strings in user input.
• Use the detection rules below.

Mitigation:

• Immediately isolate any servers running llama_index.
• Apply network segmentation to limit exposure.
• Monitor for outbound connections from the application server.

Indicators of Compromise (IOCs)

• Network: Unusual outbound connections from the application server to unknown IPs.
• File System: Unexpected files in /tmp/ or /var/tmp/ created by the application user.
• Process: Child processes spawned by the Python interpreter (e.g., sh, bash, curl).
• Logs: Entries containing safe_eval with suspicious code strings.

Detection Engineering

YARA Rule

rule CVE_2024_3271_Exploit {
    meta:
        description = "Detects exploit attempts for CVE-2024-3271 in llama_index"
        author = "Valters IT"
        date = "2025-04-10"
    strings:
        $s1 = "safe_eval" ascii wide nocase
        $s2 = "exec(" ascii wide
        $s3 = "base64" ascii wide
        $s4 = "os.system" ascii wide
    condition:
        $s1 and ($s2 or $s3 or $s4)
}

Sigma Rule

title: CVE-2024-3271 Command Injection Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit command injection in llama_index safe_eval
author: Valters IT
logsource:
    category: application
    product: python
detection:
    selection:
        EventID: 1
        Image|endswith: '\python.exe'
        CommandLine|contains: 'safe_eval'
    condition: selection
falsepositives:
    - Legitimate use of safe_eval with safe code
level: high

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2024-3271 Command Injection Attempt"; flow:to_server,established; content:"safe_eval"; nocase; content:"exec("; distance:0; within:100; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable or restrict access to any endpoints using safe_eval until a patch is available.
2. Short-term: Implement a Web Application Firewall (WAF) rule to block requests containing safe_eval combined with exec, eval, or base64.
3. Long-term: Replace safe_eval with a proper sandboxed execution environment (e.g., using subprocess with restricted permissions or a containerized approach).
4. Monitoring: Enable detailed logging for all safe_eval calls and review logs for anomalies.
5. Patch: Monitor the run-llama/llama_index repository for official patches and apply them immediately.

Valters IT
Securing Digital Frontiers