Remote Code Execution in LangChain via SQL Agent String Formatting Vulnerability
Overview
A critical vulnerability was discovered in the SQL agent of the LangChain framework, specifically in how it constructs and executes SQL queries based on user input. The issue, identified as CVE-2024-27497, stemmed from improper sanitization of user-provided input when using certain database dialects like Microsoft SQL Server. An attacker could craft a malicious prompt that, when processed by the `create_sql_agent` and passed to an `SQLDatabaseChain`, would result in a format string vulnerability. This allowed the attacker to inject arbitrary SQL commands into the query sent to the database. For example, by including specific format specifiers like `{}` within the input, an attacker could manipulate the underlying Python string formatting mechanism. This could lead to arbitrary SQL execution, enabling the attacker to read, modify, or delete sensitive data from the database. In configurations where the database user has elevated privileges, this could be escalated to full remote code execution (RCE) on the database server through functionalities like `xp_cmdshell` in SQL Server. The vulnerability highlights the inherent risks of connecting LLMs to powerful tools like SQL databases without robust, context-aware input validation and sandboxing.
Affected Systems
Testing Guide
1. **Check Version:** Verify your installed version of `langchain-community` by running `pip show langchain-community`. If the version is below `0.0.25`, you are vulnerable. 2. **Craft a Test Payload:** Create a test case using a `SQLDatabaseChain` connected to a non-production MS SQL or Oracle database. 3. **Execute Test:** Send a prompt to the agent that includes a format string specifier within a mock question, such as: `How many users are there? {}`. In vulnerable versions, this could cause a `KeyError` or unexpected SQL behavior due to the string formatting attempt. A malicious payload might look like: `'Who is the user with ID 1?'; EXEC sp_configure 'show advanced options', 1; --`. Monitor database logs for unexpected queries.
Mitigation Steps
1. **Upgrade Immediately:** Update the `langchain-community` package to version `0.0.25` or later by running `pip install --upgrade langchain-community`. 2. **Use Parameterized Queries:** Whenever possible, use database connectors that support parameterized queries to prevent SQL injection. The LangChain SQL agent has been updated to handle inputs more safely. 3. **Apply Principle of Least Privilege:** Ensure the database user account connected to the LangChain agent has the minimum necessary permissions. It should not have privileges to execute system commands or access sensitive system tables. 4. **Input Validation:** Implement an additional layer of input validation before passing user-provided data to the LangChain agent, checking for suspicious characters or SQL-like syntax.
Patch Details
Patched in `langchain-community` version 0.0.25 by improving input sanitization and handling of format strings.