CVE-2024-34359

Jinja2 Server Side Template Injection allows remote code execution.

• CVSS 9.6
• CWE-76
• Input Validation and Sanitization
• Remote

llama-cpp-python is the Python bindings for llama.cpp. `llama-cpp-python` depends on class `Llama` in `llama.py` to load `.gguf` llama.cpp or Latency Machine Learning Models. The `__init__` constructor built in the `Llama` takes several parameters to configure the loading and running of the model. Other than `NUMA, LoRa settings`, `loading tokenizers,` and `hardware settings`, `__init__` also loads the `chat template` from targeted `.gguf` 's Metadata and furtherly parses it to `llama_chat_format.Jinja2ChatFormatter.to_chat_handler()` to construct the `self.chat_handler` for this model. Nevertheless, `Jinja2ChatFormatter` parse the `chat template` within the Metadate with sandbox-less `jinja2.Environment`, which is furthermore rendered in `__call__` to construct the `prompt` of interaction. This allows `jinja2` Server Side Template Injection which leads to remote code execution by a carefully constructed payload.

CVE

CVE-2024-34359

CWE

CWE-76

CVSS base score

9.6

Published

2024-05-10

OWASP

A03 Injection

Orthogonal defect classification

Checking

Code defect classification

Incorrect Check

Category

Input Validation and Sanitization

Subcategory

Insecure Parsing or Deserialization

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Affected component

jinja2

Fixed by upgrading

Yes

Solution

Upgrade to a version of `jinja2` that implements a sandboxed environment for template rendering, such as version 3.1.0 or later.

from jinja2 import Environment

env = Environment()

def render_chat_template(user_input):
    template = env.from_string("User  says: {{ user_input }}")
    return template.render(user_input=user_input)

unsafe_input = "__import__('os').system('ls')"
output = render_chat_template(unsafe_input)
print(output)

from jinja2 import Environment, FileSystemLoader, select_autoescape

env = Environment(
    loader=FileSystemLoader('templates'),
    autoescape=select_autoescape(['html', 'xml'])
)

template = env.get_template('chat_template.jinja2')
output = template.render(user_input='input')

{{ __import__('os').system('ls') }}

@misc{vaitp:cve202434359,
  title        = {{Jinja2 Server Side Template Injection allows remote code execution.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2024},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2024-34359},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2024-34359/}}
}