CVE-2024-45848

Arbitrary code execution in MindsDB with crafted INSERT queries.

• CVSS 8.8
• CWE-94
• Input Validation and Sanitization
• Remote

An arbitrary code execution vulnerability exists in versions 23.12.4.0 up to 24.7.4.1 of the MindsDB platform, when the ChromaDB integration is installed on the server. If a specially crafted ‘INSERT’ query containing Python code is run against a database created with the ChromaDB engine, the code will be passed to an eval function and executed on the server.

CVE

CVE-2024-45848

CWE

CWE-94

CVSS base score

8.8

Published

2024-09-12

OWASP

A01 Injection

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

SQL Injection

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Affected component

MindsDB

Solution

Upgrade to MindsDB version 24.7.4.2 or later.

def execute_query(db_connection, query):
    """Vulnerable function that demonstrates the security issue."""
    if "INSERT" in query:
        eval(query)
    else:
        raise ValueError("Invalid query type")

conn = None
execute_query(conn, "INSERT INTO users (name) VALUES ('Alice'); os.system('whoami')")

import re

def execute_query(db_connection, query):
    """Secure function that fixes the vulnerability."""
    # SECURE: This version prevents command injection
    if not isinstance(query, str):
        raise ValueError("Query must be a string")

    if any(bad_keyword in query.lower() for bad_keyword in ['os.', 'system', ';', '--', '/*', '*/']):
        raise ValueError("Invalid query detected")

    insert_pattern = re.compile(r"^INSERT INTO \w+ \(\w+(, \w+)*\) VALUES \(.+\)$", re.IGNORECASE)
    if insert_pattern.match(query):
        print(f"Executing query: {query}")
    else:
        raise ValueError("Invalid query type or format")


conn = None
try:
    execute_query(conn, "INSERT INTO users (name) VALUES ('Alice'); os.system('whoami')")
except ValueError as e:
    print(f"Error: {e}")

"__import__('os').system('whoami')"

@misc{vaitp:cve202445848,
  title        = {{Arbitrary code execution in MindsDB with crafted INSERT queries.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2024},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2024-45848},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2024-45848/}}
}