CVE-2024-23751: LlamaIndex SQL injection in Text-to-SQL feature

CVE-2024-23751 · Severity: low · CVSS 3.1 · Published 2024-01-22

LlamaIndex is a popular Python framework for building applications with large language models that can query databases. The Text-to-SQL feature converts natural language queries into SQL statements to retrieve data from databases. A flaw allows attackers to inject malicious SQL commands by crafting specific text inputs (e.g., "Drop the Students table"), leading to unauthorized database modifications, data deletion, or complete database compromise without requiring authentication.

Technologies: llama-index (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2024-23751 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2024-23751 being exploited in the wild.
How severe is CVE-2024-23751?
Low severity, with a CVSS score of 3.1, published 22 January 2024.
Which products and versions are affected?
llama-index (PyPI) ECOSYSTEM:introduced=0,fixed=0.9.35, ECOSYSTEM:introduced=0,last_affected=0.9.35.
Is there a fix for CVE-2024-23751?
Yes. llama-index (PyPI): upgrade to 0.9.35 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-23751 attacked?
It is attacked over the network.
Am I affected by CVE-2024-23751?
Check whether you run llama-index (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • llama-index (PyPI): upgrade to 0.9.35 or later
    pip install "llama-index>=0.9.35"

Technical details

The vulnerability is a SQL injection flaw in the Text-to-SQL components: NLSQLTableQueryEngine, SQLTableRetrieverQueryEngine, NLSQLRetriever, RetrieverQueryEngine, and PGVectorSQLQueryEngine. The root cause is insufficient input validation and lack of parameterized query protection. An attacker can craft natural language prompts that manipulate the LLM's SQL generation logic via prompt injection to produce arbitrary SQL statements. The attack requires network access to the LlamaIndex application but no authentication; the attacker simply provides malicious text input. Successful exploitation allows dropping tables, modifying data, or executing arbitrary SQL commands with database privileges. A patch is available in versions after 0.9.35.

Affected products

  • LlamaIndex llama-index through 0.9.35

Identifiers

  • CVE-2024-23751
  • GHSA-2jxw-4hm4-6w87
  • PYSEC-2024-12

Timeline

  • 2024-01-22: disclosed: CVE-2024-23751 and GHSA-2jxw-4hm4-6w87 published
  • 2024-01-23: advisory: GitHub security advisory reviewed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.