Executive brief
LlamaIndex is a popular Python framework for building applications with large language models that can query databases. The Text-to-SQL feature converts natural language queries into SQL statements to retrieve data from databases. A flaw allows attackers to inject malicious SQL commands by crafting specific text inputs (e.g., "Drop the Students table"), leading to unauthorized database modifications, data deletion, or complete database compromise without requiring authentication.
Technical details
The vulnerability is a SQL injection flaw in the Text-to-SQL components: NLSQLTableQueryEngine, SQLTableRetrieverQueryEngine, NLSQLRetriever, RetrieverQueryEngine, and PGVectorSQLQueryEngine. The root cause is insufficient input validation and lack of parameterized query protection. An attacker can craft natural language prompts that manipulate the LLM's SQL generation logic via prompt injection to produce arbitrary SQL statements. The attack requires network access to the LlamaIndex application but no authentication; the attacker simply provides malicious text input. Successful exploitation allows dropping tables, modifying data, or executing arbitrary SQL commands with database privileges. A patch is available in versions after 0.9.35.
Affected products
- LlamaIndex llama-index through 0.9.35
Timeline
- 2024-01-22: disclosed: CVE-2024-23751 and GHSA-2jxw-4hm4-6w87 published
- 2024-01-23: advisory: GitHub security advisory reviewed