CVE-2024-58339

Executive Summary

CVE-2024-58339 is a critical uncontrolled resource consumption vulnerability (CWE-400) in the LlamaIndex library (run-llama/llama_index), specifically within the VannaPack VannaQueryEngine implementation. Versions up to and including 0.12.2 are affected. The flaw resides in the custom_query() method in llama_index/packs/vanna/base.py, which generates SQL statements from user-supplied prompts and executes them via vn.run_sql() without enforcing any query execution limits. In deployments where untrusted users can supply prompts, an attacker can trigger expensive or unbounded SQL operations, leading to CPU or memory exhaustion and a denial-of-service (DoS) condition. No patch is currently available, and no public exploit code has been identified.

Supply Chain & Package Security

This vulnerability affects the PyPI package llama-index (and its sub-packages). Organizations using LlamaIndex in AI/LLM applications that accept user prompts for SQL generation are at risk. The lack of input validation and resource limits in the VannaPack component makes it a supply chain risk for any downstream application integrating this library.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: None
• Availability Impact: High

Threat Level: High. The vulnerability is easily exploitable remotely without authentication, and the impact is a denial of service against the application or database backend.

Deep Dive & Mechanics

The vulnerability is located in the custom_query() method of the VannaQueryEngine class within llama_index/packs/vanna/base.py. The method takes a user-supplied prompt string, passes it to the Vanna AI model to generate a SQL query, and then executes that SQL query directly against the database using vn.run_sql(). There are no checks on the complexity or resource consumption of the generated SQL.

An attacker can craft a prompt that causes the AI model to generate a SQL statement designed to consume excessive resources, such as:

• A Cartesian product (CROSS JOIN) between large tables.
• A recursive Common Table Expression (CTE) with infinite loops.
• A query with extremely large LIMIT or OFFSET values.
• A query that triggers heavy aggregation or sorting on unindexed columns.

Because the SQL is executed without any timeout, row limit, or resource governor, the database server may become unresponsive, consuming all available CPU and memory, leading to a denial of service for legitimate users.

Vulnerable vs. Patched Code

Vulnerable Code (llama_index/packs/vanna/base.py, <= 0.12.2):

def custom_query(self, prompt: str) -> str:
    # Generate SQL from prompt using Vanna AI
    sql = self.vn.generate_sql(prompt)
    # Execute SQL without any limits
    result = self.vn.run_sql(sql)
    return str(result)

Patched Code (Hypothetical fix):

def custom_query(self, prompt: str) -> str:
    # Generate SQL from prompt using Vanna AI
    sql = self.vn.generate_sql(prompt)
    # Validate SQL complexity and enforce limits
    if not self._is_safe_query(sql):
        raise ValueError("Generated SQL is too complex or unsafe.")
    # Execute SQL with timeout and row limit
    result = self.vn.run_sql(sql, timeout=30, max_rows=1000)
    return str(result)

def _is_safe_query(self, sql: str) -> bool:
    # Implement checks for dangerous patterns (e.g., no CROSS JOIN, no recursive CTEs)
    # This is a simplified example
    forbidden_patterns = ["CROSS JOIN", "RECURSIVE", "UNION ALL SELECT"]
    for pattern in forbidden_patterns:
        if pattern in sql.upper():
            return False
    return True

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A target running LlamaIndex with VannaPack and an exposed endpoint that accepts user prompts.
• Network access to the target.

Exploitation Steps:

1. Identify the vulnerable endpoint: Look for API endpoints that accept a prompt parameter and return SQL query results. Example: POST /query with JSON body {"prompt": "..."}.

2. Craft a malicious prompt: Use a prompt that forces the AI to generate a resource-intensive SQL query. For example:

   • "Show me all combinations of users and orders" (may generate SELECT * FROM users CROSS JOIN orders).
   • "List all users and their orders, repeating each user 1000 times" (may generate a query with UNION ALL or large CROSS JOIN).

3. Send the request: Use curl or a script to send the malicious prompt repeatedly.

   curl -X POST http://target:8000/query \
     -H "Content-Type: application/json" \
     -d '{"prompt": "Show me all combinations of users and orders"}'
   

4. Observe DoS: The database server CPU and memory usage will spike, causing the application to become unresponsive.

Blue Team (Defense & Detection)

Detection:

• Monitor for unusually long-running SQL queries.
• Alert on queries that return excessive rows (e.g., >10,000 rows).
• Monitor database server CPU and memory usage for anomalies.

Mitigation:

• Implement a Web Application Firewall (WAF) to block requests with suspicious prompts (e.g., containing "CROSS JOIN", "RECURSIVE").
• Apply database-level resource limits (e.g., statement_timeout in PostgreSQL, MAX_EXECUTION_TIME in MySQL).
• Use a reverse proxy to rate-limit API requests.
• Upgrade to a patched version of LlamaIndex when available.

Indicators of Compromise (IOCs)

• Network: Unusually high number of requests to the /query endpoint with prompts containing SQL keywords.
• Database: Long-running queries with high resource consumption, especially those involving CROSS JOIN, UNION ALL, or recursive CTEs.
• System: High CPU and memory usage on the database server, correlated with API requests.
• Logs: Application logs showing SQL queries with excessive row counts or execution times.

Detection Engineering

YARA Rule

rule Detect_CVE_2024_58339_Exploit {
    meta:
        description = "Detects malicious prompts targeting CVE-2024-58339 in LlamaIndex"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-58339"
    strings:
        $s1 = "CROSS JOIN" nocase
        $s2 = "RECURSIVE" nocase
        $s3 = "UNION ALL" nocase
        $s4 = "SELECT * FROM" nocase
        $s5 = "LIMIT 999999" nocase
    condition:
        any of ($s1, $s2, $s3, $s4, $s5)
}

Sigma Rule

title: CVE-2024-58339 Exploit Attempt
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects SQL injection-like prompts targeting LlamaIndex VannaPack
author: Valters IT
logsource:
    category: application
    product: llama_index
detection:
    selection:
        event: "custom_query"
        prompt|contains:
            - "CROSS JOIN"
            - "RECURSIVE"
            - "UNION ALL"
            - "SELECT * FROM"
    condition: selection
falsepositives:
    - Legitimate complex queries from trusted users
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-58339 Exploit Attempt"; flow:to_server; content:"POST"; http_method; content:"/query"; http_uri; content:"prompt"; http_client_body; pcre:"/(CROSS JOIN|RECURSIVE|UNION ALL|SELECT \* FROM)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable VannaPack if not essential, or restrict access to the vulnerable endpoint.
2. Implement input validation to reject prompts containing dangerous SQL patterns.
3. Apply database-level resource limits (e.g., statement_timeout in PostgreSQL, MAX_EXECUTION_TIME in MySQL).
4. Rate-limit API requests to the vulnerable endpoint.

Long-term Fix:

• Upgrade to a patched version of LlamaIndex when available (currently no patch).
• Fork the repository and apply the hypothetical patch described in the "Vulnerable vs. Patched Code" section.
• Monitor the official LlamaIndex repository for updates.

Workarounds:

• Use a reverse proxy (e.g., Nginx) to block requests with suspicious payloads.
• Implement a custom middleware that validates the generated SQL before execution.

Valters IT
DevSecOps & Cyber Threat Intelligence