CVE-2024-45850

Arbitrary code execution in MindsDB with crafted SharePoint queries.

• CVSS 8.8
• CWE-94
• Input Validation and Sanitization
• Remote

An arbitrary code execution vulnerability exists in versions 23.10.5.0 up to 24.7.4.1 of the MindsDB platform, when the Microsoft SharePoint integration is installed on the server. For databases created with the SharePoint engine, an ‘INSERT’ query can be used for site column creation. If such a query is specially crafted to contain Python code and is run against the database, the code will be passed to an eval function and executed on the server.

CVE

CVE-2024-45850

CWE

CWE-94

CVSS base score

8.8

Published

2024-09-12

OWASP

A01 Broken Access Control

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

SQL Injection

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Affected component

MindsDB

Solution

Upgrade to MindsDB version 24.7.4.2 or later.

def execute_query(query):
    """Vulnerable function that demonstrates the security issue."""
    eval(query)

query = "INSERT INTO site_columns (name) VALUES ('code'); exec('os.system(\"ls\")')"
execute_query(query)

import ast

def execute_query(query):
    """Secure function that fixes the vulnerability."""
    # SECURE: This version prevents command injection
    ast.literal_eval(query)

query = "INSERT INTO site_columns (name) VALUES ('code'); exec('os.system(\"ls\")')"
execute_query(query)

INSERT INTO site_columns (name) VALUES ('malicious_code'); exec('os.system("whoami")')

@misc{vaitp:cve202445850,
  title        = {{Arbitrary code execution in MindsDB with crafted SharePoint queries.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2024},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2024-45850},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2024-45850/}}
}