PT-2024-6369 · Mindsdb+1 · Mindsdb+1

Published 2024-09-10 · Updated 2024-09-16 · CVE-2024-45848

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions MindsDB versions 23.12.4.0 through 24.7.4.1

Description An arbitrary code execution issue exists when the ChromaDB integration is installed on the server. If a specially crafted INSERT query containing Python code is run against a database created with the ChromaDB engine, the code will be passed to an eval function and executed on the server. This is due to incorrect management of code generation in the eval function of the MindsDB platform for data exchange automation between pipelines. Exploitation of this issue may allow a remote attacker to execute arbitrary code by injecting a specially crafted "INSERT" query.

Recommendations For MindsDB versions 23.12.4.0 through 24.7.4.1, update urgently to a version that contains a fix for this issue to stay secure. As a temporary workaround, consider disabling the ChromaDB integration until a patch is available. Restrict access to the eval function to minimize the risk of exploitation. Avoid using specially crafted INSERT queries in the affected API endpoint until the issue is resolved.

Exploit

Fix

Eval Injection

Code Injection

Weakness Enumeration

CWE-95

CWE-94

Related Identifiers

BDU:2024-07411

CVE-2024-45848

GHSA-9GQ6-6936-885W

PYSEC-2024-78

Affected Products

Chromadb

Mindsdb

References · 18

• 🔥 https://hiddenlayer.com/sai-security-advisory/2024-09-mindsdb · Exploit
• https://osv.dev/vulnerability/CVE-2024-45848 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-45848 · Security Note
• https://bdu.fstec.ru/vul/2024-07411 · Security Note
• https://osv.dev/vulnerability/PYSEC-2024-78 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9gq6-6936-885w · Vendor Advisory
• https://github.com/mindsdb/mindsdb · Note
• https://github.com/mindsdb/mindsdb/commit/11a4db792ad36cf704f7307c7602128b17752c80 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/mindsdb/PYSEC-2024-78.yaml · Note
• https://github.com/advisories/GHSA-9gq6-6936-885w · Note
• https://vulners.com/cvelist/CVELIST:CVE-2024-45848 · Note
• https://twitter.com/CveFindCom/status/1834216549047058493 · Twitter Post
• https://t.me/latest_high_impact_cve/1137 · Telegram Post
• https://twitter.com/cracbot/status/1835921715811201305 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1834242020518338643 · Twitter Post