CVE-2024-6841: Vanna AI CSRF Vulnerability in SQL Endpoints

CVE-2024-6841 Overview

CVE-2024-6841 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] in the vanna-ai/vanna repository. The flaw affects commit 56b782bcefd2e59b19cd7ba7878b95f54884f502. Two endpoints in the built-in web application expose SQL functionality through simple HTTP GET requests. These endpoints lack CSRF protections such as tokens or origin validation. An attacker can craft a malicious page that triggers arbitrary SQL commands when a victim with an active session visits it. The impact is limited to data alteration or deletion, because the attacker cannot read responses from the victim's browser.

Critical Impact

Attackers can execute arbitrary SQL commands against a victim's Vanna instance through a forged GET request, leading to data modification or destruction without the victim's consent.

Affected Products

• vanna-ai/vanna repository at commit 56b782bcefd2e59b19cd7ba7878b95f54884f502
• Vanna built-in web application exposing SQL endpoints
• Deployments that run the Vanna web interface reachable from a user's browser session

Discovery Timeline

• 2025-03-20 - CVE-2024-6841 published to the National Vulnerability Database
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-6841

Vulnerability Analysis

Vanna is an open-source Python framework for generating SQL queries using large language models. The project ships with an optional web application that lets users run SQL interactively. Two of those endpoints handle sensitive SQL operations through HTTP GET requests. Because browsers automatically attach session cookies to cross-origin GET requests, any site a victim visits can issue these requests on their behalf. The server executes the attacker-supplied SQL against the backend database. The Same-Origin Policy prevents the attacker from reading responses, so confidentiality is unaffected. Integrity, however, is directly compromised through writes, updates, and deletes.

Root Cause

The root cause is the use of state-changing GET endpoints without CSRF protections. The affected routes do not require anti-CSRF tokens, do not validate the Origin or Referer headers, and do not enforce SameSite cookie attributes. HTTP semantics state that GET requests should be safe and idempotent. Placing SQL execution behind GET violates that contract and makes the endpoints trivially exploitable through standard CSRF techniques.

Attack Vector

Exploitation requires an authenticated user to visit an attacker-controlled page while a Vanna web session is active. The attacker embeds a resource such as an <img> tag, hidden <iframe>, or auto-submitted form targeting the vulnerable endpoint. The browser issues the GET request with the user's session cookies attached. The Vanna backend executes the SQL payload supplied in the query string. No user interaction beyond page navigation is required. Full technical details are available in the Huntr bug bounty listing.

Detection Methods for CVE-2024-6841

Indicators of Compromise

• Unexpected DELETE, UPDATE, DROP, or INSERT statements recorded in database audit logs originating from the Vanna application user
• HTTP GET requests to Vanna SQL endpoints that carry a Referer header pointing to an unrelated or unknown domain
• Vanna application logs showing SQL execution events outside of normal user working hours or in rapid succession

Detection Strategies

• Correlate web server access logs with database transaction logs to flag state-changing SQL issued through GET requests
• Alert when requests to Vanna SQL endpoints lack a same-origin Referer or Origin header
• Review browser proxy or network capture data for cross-origin requests to internal Vanna hostnames

Monitoring Recommendations

• Enable verbose SQL audit logging on databases connected to Vanna and forward events to a centralized log platform
• Monitor for anomalous spikes in write operations attributable to the Vanna service account
• Track user agent, referrer, and source IP patterns on the Vanna web app to identify forged request sources

How to Mitigate CVE-2024-6841

Immediate Actions Required

• Restrict access to the Vanna web application so that it is not reachable from untrusted networks or shared browser sessions
• Terminate active Vanna web sessions and require re-authentication after applying mitigations
• Review database audit logs for unauthorized data modification since the Vanna instance was first deployed

Patch Information

At the time of publication, no official vendor patch reference is listed in the NVD record. Monitor the Huntr bug bounty listing and the upstream vanna-ai/vanna repository for a fix that converts the affected endpoints to POST, enforces CSRF tokens, and validates request origins.

Workarounds

• Bind the Vanna web application to localhost only and access it through an SSH tunnel instead of exposing it on the network
• Place the web app behind a reverse proxy that strips cross-origin requests and enforces strict Referer and Origin header validation
• Set session cookies with the SameSite=Strict attribute to prevent browsers from attaching them to cross-site GET requests
• Isolate the Vanna instance in a separate browser profile or container that is not used for general browsing

# Example NGINX reverse-proxy snippet that blocks cross-origin GETs to Vanna
location /vanna/ {
    if ($http_origin !~* ^https?://(localhost|vanna\.internal\.example\.com)$) {
        return 403;
    }
    if ($http_referer !~* ^https?://(localhost|vanna\.internal\.example\.com)/) {
        return 403;
    }
    proxy_pass http://127.0.0.1:8000/;
    proxy_cookie_path / "/; SameSite=Strict; HttpOnly; Secure";
}