CVE-2024-45847

Arbitrary code execution in MindsDB via crafted UPDATE queries.

• CVSS 8.8
• CWE-94
• Input Validation and Sanitization
• Remote

An arbitrary code execution vulnerability exists in versions 23.11.4.2 up to 24.7.4.1 of the MindsDB platform, when one of several integrations is installed on the server. If a specially crafted ‘UPDATE’ query containing Python code is run against a database created with the specified integration engine, the code will be passed to an eval function and executed on the server.

CVE

CVE-2024-45847

CWE

CWE-94

CVSS base score

8.8

Published

2024-09-12

OWASP

A01 Injection

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

SQL Injection

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Affected component

MindsDB plat

Solution

Upgrade to MindsDB version 24.7.4.2 or later.

def update_query(query):
    """Vulnerable function that demonstrates the security issue."""
    eval(query)

update_query("UPDATE my_table SET column='value'; os.system('command')")

import ast

def update_query(query):
    """Secure function that fixes the vulnerability."""
    # SECURE: This version prevents command injection
    ast.literal_eval(query)

update_query("UPDATE my_table SET column='value'; os.system('command')")

UPDATE my_table SET column='value'; os.system("whoami")

@misc{vaitp:cve202445847,
  title        = {{Arbitrary code execution in MindsDB via crafted UPDATE queries.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2024},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2024-45847},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2024-45847/}}
}