Remote Code Execution in LlamaIndex via Deserialization of Malicious Tool Output
Overview
A critical vulnerability was discovered in the LlamaIndex framework's handling of custom tool outputs. When an LLM agent uses a tool, the tool's output is typically returned as a string. However, a specific component, `JSONAgentTool`, was found to use Python's `eval()` function to parse a JSON string from a tool's output if it suspected a complex object. This was intended to automatically deserialize JSON into Python objects for easier processing. An attacker could exploit this by crafting a malicious web-based tool that the agent could be tricked into calling (e.g., via indirect prompt injection). This malicious tool would return a carefully crafted string that, while appearing like JSON, was actually a valid Python expression such as `__import__('os').system('...command...')`. When the `JSONAgentTool` component received this output, it would pass the string to `eval()`, leading to arbitrary code execution on the machine running the LlamaIndex application. The impact is severe, as it allows a remote attacker to gain full control over the application server by tricking an agent into interacting with a malicious endpoint. The vulnerability bypasses standard prompt injection defenses as it targets the data processing logic after the tool has already been executed.
Affected Systems
Testing Guide
1. Check your LlamaIndex version by running `pip show llama-index`. If the version is below 0.10.50, you are vulnerable. 2. Create a test case with a custom tool that returns a malicious Python expression as a string (e.g., `"__import__('os').system('touch /tmp/pwned')"`). 3. Use an agent configured with `JSONAgentTool` to call this malicious tool. 4. Check if the file `/tmp/pwned` was created on the host system. If so, your application is vulnerable.
Mitigation Steps
1. Upgrade LlamaIndex to version `0.10.50` or later immediately. 2. If upgrading is not possible, audit your code for any usage of `JSONAgentTool` or other custom tools that use `eval()` on tool outputs. 3. Replace any instances of `eval()` with the safer `json.loads()` for parsing JSON data. 4. Sanitize and validate all data received from external tools before processing it within your application.
Patch Details
Patched in LlamaIndex version 0.10.50. The `eval()` call was replaced with the safe `json.loads()` parser.