CVE-2024-3571

Executive Summary

CVE-2024-3571 is a path traversal vulnerability in the langchain-ai/langchain library, specifically within the LocalFileStore functionality. The vulnerability arises from improper sanitization of user-supplied file paths in the mset and mget methods, allowing an attacker to traverse directories outside the intended storage directory. This can lead to unauthorized read or write access to arbitrary files on the filesystem, potentially resulting in information disclosure or remote code execution. The CVSS score is 6.5 (Medium), but the actual impact could be critical depending on the deployment context. No public exploit code or patch details are currently available.

Supply Chain & Package Security

This vulnerability affects the langchain Python package, which is widely used in AI/LLM application development. Organizations using langchain in production environments should treat this as a high-priority supply chain risk. The lack of a confirmed patch means that any application using LocalFileStore with untrusted input is vulnerable. Immediate mitigation steps include restricting filesystem access and input validation.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 6.5 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: High (due to potential for RCE and data exfiltration)

Deep Dive & Mechanics

The vulnerability is located in the LocalFileStore class within the langchain library. The mset and mget methods are designed to store and retrieve data from a local filesystem directory. However, they fail to properly validate or sanitize the key parameter, which is used to construct file paths.

Root Cause: The key parameter is concatenated directly with the base storage path without checking for directory traversal sequences (e.g., ../). An attacker can supply a key like ../../etc/passwd to read or write files outside the intended directory.

Attack Flow:

1. The attacker identifies an endpoint that uses LocalFileStore with user-controlled keys.
2. The attacker sends a request with a malicious key containing path traversal sequences.
3. The mset or mget method constructs a file path by joining the base path with the attacker-supplied key.
4. The file operation is performed on the traversed path, allowing the attacker to read or write arbitrary files.

Impact:

• Information Disclosure: Reading sensitive files (e.g., /etc/passwd, configuration files, SSH keys).
• Remote Code Execution: Writing malicious files (e.g., Python scripts, cron jobs, web shells) to executable locations.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

class LocalFileStore:
    def __init__(self, base_path):
        self.base_path = base_path

    def mset(self, key, value):
        file_path = os.path.join(self.base_path, key)  # No sanitization
        with open(file_path, 'w') as f:
            f.write(value)

    def mget(self, key):
        file_path = os.path.join(self.base_path, key)  # No sanitization
        with open(file_path, 'r') as f:
            return f.read()

Patched Code (Conceptual):

import os

class LocalFileStore:
    def __init__(self, base_path):
        self.base_path = os.path.abspath(base_path)

    def _sanitize_key(self, key):
        # Resolve the full path and ensure it stays within base_path
        full_path = os.path.abspath(os.path.join(self.base_path, key))
        if not full_path.startswith(self.base_path):
            raise ValueError("Invalid key: path traversal detected")
        return full_path

    def mset(self, key, value):
        safe_path = self._sanitize_key(key)
        with open(safe_path, 'w') as f:
            f.write(value)

    def mget(self, key):
        safe_path = self._sanitize_key(key)
        with open(safe_path, 'r') as f:
            return f.read()

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A target application using langchain with LocalFileStore exposed via an API.
• The attacker can control the key parameter in mset or mget calls.

Exploitation Steps:

1. Reconnaissance: Identify endpoints that accept file keys (e.g., /store?key=...).
2. Craft Payload: Use path traversal sequences to target sensitive files.
   • Read /etc/passwd: key=../../etc/passwd
   • Write a web shell: key=../../var/www/html/shell.py
3. Execute: Send the crafted request to the vulnerable endpoint.

Example Request (Read):

curl -X GET "http://target.com/store?key=../../etc/passwd"

Example Request (Write):

curl -X POST "http://target.com/store" -d "key=../../tmp/evil.sh&value=#!/bin/bash%0Aecho%20pwned"

Blue Team (Defense & Detection)

Detection:

• Monitor for file paths containing ../ or ..\\ in API parameters.
• Alert on file operations outside the expected base directory.
• Use file integrity monitoring (FIM) to detect unauthorized file changes.

Mitigation:

• Apply input validation to reject any key containing ../ or ..\\.
• Use a whitelist of allowed characters for keys (e.g., alphanumeric only).
• Run the application in a container with restricted filesystem access.
• Implement a Web Application Firewall (WAF) rule to block path traversal patterns.

Indicators of Compromise (IOCs)

• File Paths: Any file path containing ../ or ..\\ in API requests.
• Log Entries: Unusual file access patterns, especially to /etc, /var/www, or /tmp.
• Network Traffic: Requests with encoded path traversal sequences (e.g., %2e%2e%2f).
• System Changes: Unexpected files in sensitive directories (e.g., /tmp/evil.sh).

Detection Engineering

YARA Rule

rule CVE_2024_3571_PathTraversal {
    meta:
        description = "Detects path traversal attempts targeting langchain LocalFileStore"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-3571"
    strings:
        $traversal1 = "../"
        $traversal2 = "..\\"
        $traversal3 = "%2e%2e%2f"
        $traversal4 = "%2e%2e%5c"
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-3571 Path Traversal in langchain LocalFileStore
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects path traversal attempts in HTTP requests targeting langchain LocalFileStore
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 
            - 'GET'
            - 'POST'
        cs-uri-query|contains: 
            - '../'
            - '..\\'
            - '%2e%2e%2f'
            - '%2e%2e%5c'
    condition: selection
falsepositives:
    - Legitimate use of relative paths in non-vulnerable applications
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-3571 Path Traversal in langchain LocalFileStore"; flow:to_server; content:"../"; http_uri; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable LocalFileStore if not essential, or restrict its use to trusted internal networks.
2. Implement Input Validation: Reject any key containing ../, ..\\, or URL-encoded variants.
3. Use a Whitelist: Only allow alphanumeric characters and underscores in keys.
4. Apply Filesystem Restrictions: Run the application in a chroot jail or container with read-only root filesystem.

Long-Term Fix:

• Apply the conceptual patch shown above to sanitize file paths.
• Monitor the official langchain repository for a security patch and update immediately.
• Conduct a code review of all file path operations in the application.

Valters IT Signature This report was generated by Valters IT Cyber Threat Intelligence Division. For questions, contact threatintel@valtersit.com.