CVE-2024-8864

Critical code injection vulnerability in Composio's Calculator function.

• CVSS 5.1
• CWE-94
• Input Validation and Sanitization
• Remote

A vulnerability has been found in composiohq composio up to 0.5.6 and classified as critical. Affected by this vulnerability is the function Calculator of the file python/composio/tools/local/mathematical/actions/calculator.py. The manipulation leads to code injection. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVE

CVE-2024-8864

CWE

CWE-94

CVSS base score

5.1

Published

2024-09-15

OWASP

A01 Injection

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Command Injection

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Affected component

composio

Fixed by upgrading

Yes

Solution

Upgrade to composio 0.5.7 or later.

class Calculator:
    def calculate(self, expression):
        """Vulnerable function that demonstrates the security issue."""
        return eval(expression)

        calculator = Calculator()
        print(calculator.calculate("2 + 2"))
        print(calculator.calculate("__import__('os').system('ls')"))

import ast

class Calculator:
    def calculate(self, expression):
        """Secure function that fixes the vulnerability."""
    # SECURE: This version prevents command injection
        try:
            result = ast.literal_eval(expression)
            return result
            except (ValueError, SyntaxError):
                return "Invalid expression"

                calculator = Calculator()
                print(calculator.calculate("2 + 2"))
                print(calculator.calculate("__import__('os').system('ls')"))

"__import__('os').system('ls')"

@misc{vaitp:cve20248864,
  title        = {{Critical code injection vulnerability in Composio's Calculator function.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2024},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2024-8864},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2024-8864/}}
}