CVE-2024-27444

LangChain < 0.1.8 allows code execution via attribute bypass of CVE-2023-44467.

• CVSS 9.8
• CWE-749
• Input Validation and Sanitization
• Remote

langchain_experimental (aka LangChain Experimental) in LangChain before 0.1.8 allows an attacker to bypass the CVE-2023-44467 fix and execute arbitrary code via the __import__, __subclasses__, __builtins__, __globals__, __getattribute__, __bases__, __mro__, or __base__ attribute in Python code. These are not prohibited by pal_chain/base.py.

CVE

CVE-2024-27444

CWE

CWE-749

CVSS base score

9.8

Published

2024-02-26

OWASP

A01 Broken Access Control

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Insecure Parsing or Deserialization

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Affected component

LangChain

Fixed by upgrading

Yes

Solution

Upgrade to LangChain version 0.1.8 or later.

def execute_code(code):
    """Vulnerable function that demonstrates the security issue."""
    exec(code)

code = "__import__('os').system('echo Vulnerable!')"

execute_code(code)

def check_code(code):
    """Secure function that fixes the vulnerability."""
    blacklist = ['__import__', 'os', 'sys', 'subprocess', 'eval', 'exec', 'open', 'input', 'compile', 'globals', 'locals']
    return not any(black_item in code for black_item in blacklist)

def execute_code(code):
    """Secure function that fixes the vulnerability."""
    if check_code(code):
        exec(code)
    else:
        print("Error: Unsafe code detected!")

code = "__import__('os').system('echo Vulnerable!')"
execute_code(code)

"__import__('os').system('echo Exploited!')"

@misc{vaitp:cve202427444,
  title        = {{LangChain < 0.1.8 allows code execution via attribute bypass of CVE-2023-44467.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2024},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2024-27444},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2024-27444/}}
}