CVE-2024-45846

Arbitrary code execution in MindsDB with Weaviate integration via SQL.

• CVSS 8.8
• CWE-94
• Input Validation and Sanitization
• Remote

An arbitrary code execution vulnerability exists in versions 23.10.3.0 up to 24.7.4.1 of the MindsDB platform, when the Weaviate integration is installed on the server. If a specially crafted ‘SELECT WHERE’ clause containing Python code is run against a database created with the Weaviate engine, the code will be passed to an eval function and executed on the server.

CVE

CVE-2024-45846

CWE

CWE-94

CVSS base score

8.8

Published

2024-09-12

OWASP

A01 Broken Access Control

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Command Injection

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Affected component

MindsDB

Solution

Upgrade to MindsDB version 24.7.4.2 or later.

def select_where(query):
    """Vulnerable function that demonstrates the security issue."""
    result = eval(query)
    return result

user_input = "os.system('echo Vulnerable!')"
select_where(user_input)

import ast

def select_where(query):
    """Secure function that fixes the vulnerability."""
    # SECURE: This version prevents command injection
    try:
        result = ast.literal_eval(query)
        return result
    except (ValueError, SyntaxError):
        return "Invalid input"

user_input = "os.system('echo Vulnerable!')"
select_where(user_input)

__import__('os').system('echo Vulnerable!')

@misc{vaitp:cve202445846,
  title        = {{Arbitrary code execution in MindsDB with Weaviate integration via SQL.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2024},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2024-45846},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2024-45846/}}
}