Remote Code Execution in LlamaIndex via Unsafe YAML Parsing in SimpleDirectoryReader
Overview
A critical remote code execution (RCE) vulnerability was discovered in multiple versions of LlamaIndex, a popular data framework for LLM applications. The vulnerability existed within the `SimpleDirectoryReader` component when it was used to parse files with `.yaml` or `.yml` extensions. By default, `SimpleDirectoryReader` leveraged the `PyYAML` library's `yaml.full_load()` function, which is unsafe as it can deserialize and execute arbitrary Python code if a specially crafted YAML file is processed. An attacker could exploit this by tricking an application into indexing a directory containing a malicious YAML file. For example, in a Retrieval-Augmented Generation (RAG) system that allows users to upload documents for indexing, an attacker could upload a malicious file disguised as configuration. When the LlamaIndex application processes this file, the payload within the YAML would execute with the permissions of the application process. This could lead to complete server compromise, data exfiltration, or further network penetration. The vulnerability was introduced due to the use of the insecure `full_load` function instead of the recommended `safe_load`. The LlamaIndex maintainers have released a patch that changes the default YAML parser to `yaml.safe_load()` for all related operations and have marked `full_load` for deprecation in the component.
Affected Systems
Testing Guide
1. Check your `llama-index` version by running `pip show llama-index`. If the version is below 0.10.50, you are vulnerable. 2. Create a test YAML file named `exploit.yaml` with the following content: `!!python/object/apply:os.system ["touch /tmp/pwned"]` 3. Write a simple Python script that uses `SimpleDirectoryReader` to load files from a directory containing `exploit.yaml`. 4. Run the script. If the file `/tmp/pwned` is created, your application is vulnerable to RCE.
Mitigation Steps
1. **Upgrade immediately**: Update to the latest version of `llama-index` by running `pip install --upgrade llama-index`. 2. **Restrict file types**: If immediate upgrade is not possible, configure your `SimpleDirectoryReader` to explicitly exclude `.yaml` and `.yml` files if they are not required. 3. **Sanitize inputs**: In applications where users can upload documents, implement strict file type validation and content scanning before passing files to any indexing framework. 4. **Run with least privilege**: Execute your LlamaIndex application in a sandboxed environment (e.g., a container) with minimal permissions to limit the impact of a potential RCE.
Patch Details
Patched in llama-index version 0.10.50 and later. The fix replaces `yaml.full_load()` with `yaml.safe_load()`.