CVE-2024-11958: Llamaindex SQL Injection Vulnerability

CVE-2024-11958 Overview

A SQL injection vulnerability exists in the duckdb_retriever component of the run-llama/llama_index repository. The vulnerability arises from the construction of SQL queries without using prepared statements, allowing an attacker to inject arbitrary SQL code. This can lead to remote code execution (RCE) by installing the shellfs extension and executing malicious commands.

Critical Impact

Unauthenticated attackers can exploit this SQL injection vulnerability to achieve remote code execution on systems running LlamaIndex with the DuckDB retriever component, potentially leading to complete system compromise.

Affected Products

• LlamaIndex DuckDB Retriever versions prior to 0.4.0
• Applications using llama-index-retrievers-duckdb-retriever package
• Systems integrating LlamaIndex with DuckDB for retrieval-augmented generation (RAG)

Discovery Timeline

• 2025-03-20 - CVE CVE-2024-11958 published to NVD
• 2025-07-29 - Last updated in NVD database

Technical Details for CVE-2024-11958

Vulnerability Analysis

This vulnerability represents a classic SQL injection flaw in an AI/ML framework context. The duckdb_retriever component constructs SQL queries by directly concatenating user-supplied input without proper sanitization or parameterization. DuckDB, being an embedded analytical database, supports extensions that can interact with the file system. Attackers can leverage this capability by injecting SQL commands that install the shellfs extension, which provides file system access and command execution capabilities.

The exploitation chain involves: injecting malicious SQL through the retriever interface, installing the shellfs extension via DuckDB's extension mechanism, and then executing arbitrary shell commands on the underlying system. This transforms what might appear to be a database vulnerability into a full remote code execution primitive.

Root Cause

The root cause is the failure to use prepared statements when constructing SQL queries in the DuckDBRetriever class. User-controlled input from query operations is directly interpolated into SQL strings, creating an injection point. The fix addresses this by implementing proper parameterized queries using DuckDB's prepared statement functionality, ensuring that user input is treated as data rather than executable SQL code.

Attack Vector

The attack is network-accessible and requires no authentication or user interaction. An attacker can send specially crafted queries to an application using the vulnerable DuckDB retriever component. The malicious payload would contain SQL injection sequences that break out of the intended query context and execute attacker-controlled SQL statements.

The attack chain typically follows this pattern:

1. Attacker identifies an application using LlamaIndex with DuckDB retriever
2. Malicious query input is submitted containing SQL injection payload
3. The payload installs the shellfs extension via INSTALL shellfs; LOAD shellfs;
4. Subsequent payload executes system commands through shellfs functions
5. Attacker achieves remote code execution on the target system

 import os
 from typing import List, Optional
 
+import duckdb
 from llama_index.core.base.base_retriever import BaseRetriever
 from llama_index.core.callbacks.base import CallbackManager
 from llama_index.core.constants import DEFAULT_SIMILARITY_TOP_K
-from llama_index.core.schema import TextNode, NodeWithScore, QueryBundle
+from llama_index.core.schema import NodeWithScore, QueryBundle, TextNode
 
 logger = logging.getLogger(__name__)
-import_err_msg = "`duckdb` package not found, please run `pip install duckdb`"
 
 
 class DuckDBLocalContext:

Source: GitHub Commit

Detection Methods for CVE-2024-11958

Indicators of Compromise

• Unexpected DuckDB extension installations, particularly shellfs or other file-system related extensions
• Anomalous SQL query patterns containing INSTALL, LOAD, or system command execution syntax
• Unusual process spawning from Python processes running LlamaIndex applications
• File system access or modifications from DuckDB database processes

Detection Strategies

• Monitor application logs for SQL error messages indicating injection attempts with malformed queries
• Implement query logging in DuckDB to capture and analyze executed SQL statements for injection patterns
• Deploy web application firewall (WAF) rules to detect common SQL injection payloads in API requests
• Use runtime application self-protection (RASP) to detect unexpected SQL execution patterns

Monitoring Recommendations

• Enable verbose logging for LlamaIndex retriever operations to capture query details
• Monitor for process creation events from Python interpreter processes running AI/ML workloads
• Implement file integrity monitoring on systems hosting LlamaIndex applications
• Set up alerts for DuckDB extension loading events in production environments

How to Mitigate CVE-2024-11958

Immediate Actions Required

• Upgrade llama-index-retrievers-duckdb-retriever to version 0.4.0 or later immediately
• Audit applications using LlamaIndex with DuckDB for potential exposure to this vulnerability
• Review access controls and network segmentation for systems running vulnerable versions
• Implement input validation at the application layer as defense-in-depth

Patch Information

The vulnerability has been addressed in commit 35bd221e948e40458052d30c6ef2779bc965b6d0, which implements prepared statements in the DuckDBRetriever component. The fix is available in llama-index-retrievers-duckdb-retriever version 0.4.0. The patch properly imports the DuckDB module directly and refactors query construction to use parameterized queries instead of string concatenation.

For additional technical details, refer to the Huntr Bounty Report and the GitHub security commit.

Workarounds

• Disable or remove the DuckDB retriever component if not actively required until patching is possible
• Implement strict input validation and sanitization before data reaches the retriever layer
• Deploy network segmentation to limit exposure of vulnerable LlamaIndex services
• Configure DuckDB to run in restricted mode, disabling extension loading if feasible for your use case

# Upgrade to patched version
pip install --upgrade llama-index-retrievers-duckdb-retriever>=0.4.0

# Verify installed version
pip show llama-index-retrievers-duckdb-retriever | grep Version