CVE-2024-3098: llama_index safe_eval RCE Vulnerability

CVE-2024-3098 Overview

A critical vulnerability was identified in the exec_utils class of the llama_index package, specifically within the safe_eval function. This flaw allows for prompt injection attacks that can lead to arbitrary code execution on affected systems. The vulnerability arises due to insufficient validation of input, which can be exploited to bypass method restrictions and execute unauthorized code.

This security issue represents a bypass of the previously addressed CVE-2023-39662, indicating that the original fix was incomplete. Security researchers have demonstrated exploitation through a proof of concept that successfully creates files on the target system by leveraging this flaw.

Critical Impact

Attackers can achieve arbitrary code execution through prompt injection by bypassing the safe_eval function's method restrictions, potentially leading to complete system compromise.

Affected Products

• LlamaIndex (llama_index Python package) - versions prior to the security fix
• Applications utilizing the exec_utils.safe_eval function
• AI/LLM applications built on vulnerable LlamaIndex versions

Discovery Timeline

• 2024-04-10 - CVE-2024-3098 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-3098

Vulnerability Analysis

This vulnerability falls under CWE-94 (Improper Control of Generation of Code), commonly known as Code Injection. The safe_eval function in LlamaIndex's exec_utils class was designed to provide a secure evaluation mechanism for user-supplied input. However, the implementation contains insufficient input validation that allows attackers to craft malicious prompts that bypass the intended method restrictions.

The flaw is particularly concerning as it represents a bypass of CVE-2023-39662, indicating that attackers found novel techniques to circumvent the previous security controls. This demonstrates the inherent difficulty in implementing truly safe evaluation functions for dynamic input, especially in the context of LLM applications where prompt injection is an emerging threat vector.

The network-accessible nature of this vulnerability, combined with no authentication requirements, makes it particularly dangerous in production AI/LLM deployments where user input flows through the vulnerable code path.

Root Cause

The root cause lies in the inadequate input validation within the safe_eval function. The function fails to properly sanitize or restrict certain input patterns, allowing carefully crafted prompts to escape the evaluation sandbox. This insufficient validation enables attackers to inject code that bypasses the method restrictions that were intended to prevent arbitrary code execution.

The original fix for CVE-2023-39662 addressed some attack vectors but did not account for all possible bypass techniques, leaving the code vulnerable to alternative exploitation methods.

Attack Vector

The attack vector is network-based, requiring no privileges or user interaction to exploit. An attacker can craft a malicious prompt that, when processed by the safe_eval function, executes arbitrary code on the target system. The exploitation technique involves:

1. Constructing a specially crafted input string designed to bypass method restrictions
2. Injecting this payload through any interface that processes user input via safe_eval
3. Achieving code execution when the vulnerable function evaluates the malicious input

The proof of concept demonstrates file creation capabilities, but the arbitrary code execution nature of this vulnerability means attackers could potentially achieve full system compromise, data exfiltration, or lateral movement within a network.

Detection Methods for CVE-2024-3098

Indicators of Compromise

• Unexpected file creation or modification in application directories
• Anomalous process spawning from Python/LlamaIndex processes
• Unusual network connections originating from AI/LLM application servers
• Error logs indicating evaluation failures or sandbox escapes in exec_utils

Detection Strategies

• Monitor application logs for suspicious input patterns targeting the safe_eval function
• Implement runtime application self-protection (RASP) to detect code injection attempts
• Deploy behavioral analysis to identify anomalous code execution patterns
• Review audit logs for unexpected system calls from LlamaIndex processes

Monitoring Recommendations

• Enable verbose logging for the exec_utils module to capture evaluation attempts
• Set up alerts for file system modifications in restricted directories
• Monitor process trees for unexpected child processes spawned by the application
• Implement network egress monitoring for AI/LLM application servers

How to Mitigate CVE-2024-3098

Immediate Actions Required

• Update the llama_index package to the latest patched version immediately
• Review application code for any direct usage of the safe_eval function
• Implement additional input validation layers before data reaches safe_eval
• Consider temporarily disabling functionality that relies on dynamic code evaluation

Patch Information

The LlamaIndex development team has addressed this vulnerability in a security commit. The fix is available in the GitHub repository commit 5fbcb5a8b9f20f81b791c7fc8849e352613ab475. Organizations should update to a version that includes this commit or later.

For detailed information about the vulnerability discovery and technical analysis, refer to the Huntr Bounty Report.

Workarounds

• Implement strict input sanitization before any data reaches the safe_eval function
• Deploy the application in a sandboxed or containerized environment with restricted permissions
• Use allowlisting for permitted operations rather than blocklisting dangerous functions
• Consider removing or replacing functionality that depends on dynamic code evaluation with safer alternatives

# Update llama_index to the latest patched version
pip install --upgrade llama_index

# Verify the installed version includes the security fix
pip show llama_index

# For production environments, pin to a known secure version
pip install llama_index>=0.10.0