by Kastro
Paper/Archive/CVE-2024-12909

CVE-2024-12909

run-llama run-llama/llama_index — SQL Injection to RCE in run-llama/llama_index

EPSS 1%public exploitCVSS 10.0
critical.is priorityof 100
55
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 73.3.733 × 2014.7Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

A vulnerability in the FinanceChatLlamaPack of the run-llama/llama_index repository, versions up to v0.12.3, allows for SQL injection in the `run_sql_query` function of the `database_agent`. This vulnerability can be exploited by an attacker to inject arbitrary SQL queries, leading to remote code execution (RCE) through the use of PostgreSQL's large object functionality. The issue is fixed in version 0.3.0.

Affected

ProductAffectedFixed inSource
run-llama/llama_indexunspecified – < 0.3.00.3.0CNA

Scores by source

@huntr_ai (CNA)10.0CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

refhuntr.com/bounties/44e8177f-200a-4ba3-a12c-8bc21e313a3frefgithub.com/run-llama/llama_index/commit/5d03c175476452db9b8abcdb7d5767dd7b310a75