CVE-2024-5753 Overview
CVE-2024-5753 is a SQL injection vulnerability affecting vanna-ai/vanna version 0.3.4. The flaw resides in file-critical PostgreSQL functions such as pg_read_file() that are exposed through a Python Flask API. Unauthenticated remote attackers can inject SQL payloads to read arbitrary local files on the victim server, including sensitive files such as /etc/passwd. The vulnerability is classified under CWE-89 and impacts confidentiality without requiring authentication or user interaction.
Critical Impact
Unauthenticated remote attackers can read arbitrary files from the host filesystem by injecting SQL through exposed Flask API endpoints, exposing credentials, configuration, and system data.
Affected Products
- vanna-ai/vanna version 0.3.4
- Deployments exposing the Flask API with PostgreSQL backends
- Applications embedding the affected pg_read_file() code path
Discovery Timeline
- 2024-07-05 - CVE-2024-5753 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-5753
Vulnerability Analysis
vanna-ai/vanna is a Python library that generates SQL queries from natural language prompts and executes them against a configured database. In version 0.3.4, user-supplied input reaches SQL execution paths in the Flask API layer without sufficient sanitization or parameterization. Attackers can craft prompts or requests that produce SQL statements invoking PostgreSQL server-side functions like pg_read_file(), pg_ls_dir(), and related file-access primitives. These functions execute with the privileges of the PostgreSQL role connected to the application, granting attackers a path to disk data through the database engine.
Root Cause
The root cause is insufficient input validation and improper neutralization of special elements in SQL commands [CWE-89]. The application constructs SQL queries that can incorporate attacker-controlled fragments, allowing the injection of calls to file-critical PostgreSQL functions. No authentication check gates the vulnerable Flask API endpoints, so exposure to untrusted networks results in direct exploitability.
Attack Vector
Exploitation occurs over the network against the Flask API. An attacker sends a crafted request that produces or influences a SQL statement executed by the backend. By injecting a call to pg_read_file('/etc/passwd') or similar functions, the response returns the contents of local files. Because the CVSS impact is confidentiality-only, the primary risk is information disclosure of secrets, tokens, private keys, and configuration files that can enable follow-on compromise.
See the Huntr Bug Bounty Report for the original technical write-up.
Detection Methods for CVE-2024-5753
Indicators of Compromise
- HTTP requests to Flask API endpoints containing SQL keywords such as pg_read_file, pg_ls_dir, or pg_read_binary_file.
- PostgreSQL query logs showing execution of file-access functions initiated by the vanna application role.
- Unexpected outbound responses from the API containing contents of system files such as /etc/passwd or /etc/shadow.
- Anomalous request payloads referencing filesystem paths in natural-language prompt parameters.
Detection Strategies
- Enable PostgreSQL statement logging and alert on invocations of pg_read_file, pg_ls_dir, and COPY ... FROM PROGRAM executed by the application user.
- Deploy a web application firewall rule that inspects request bodies for SQL function names associated with file access.
- Correlate Flask API access logs with database query logs to identify prompt-to-query patterns that yield file contents.
Monitoring Recommendations
- Monitor the vanna Flask process for unusual response sizes indicating leaked file contents.
- Track database role privileges to ensure the application role cannot invoke superuser file functions.
- Log and review all natural-language prompts submitted to the vanna endpoint for adversarial patterns.
How to Mitigate CVE-2024-5753
Immediate Actions Required
- Restrict network access to the vanna Flask API using firewall rules or reverse proxy authentication.
- Revoke superuser and file-access privileges from the PostgreSQL role used by vanna, granting only the minimum privileges required.
- Audit recent PostgreSQL logs for prior invocations of pg_read_file() and related functions to identify possible exploitation.
Patch Information
No vendor patch is documented in the NVD entry at the time of publication. Consult the Huntr Bug Bounty Report and the vanna-ai/vanna project repository for the latest fixed release and upgrade guidance before deploying newer versions.
Workarounds
- Run the vanna application against a PostgreSQL role that lacks pg_read_server_files role membership and superuser status.
- Place the Flask API behind an authenticated gateway to eliminate unauthenticated exposure.
- Enforce prompt and query allowlists that reject SQL fragments referencing filesystem functions such as pg_read_file, pg_ls_dir, and COPY ... FROM PROGRAM.
- Isolate the database host on a network segment that cannot access sensitive files outside the intended data directory.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
