CVE-2024-45849

Advisory

A critical arbitrary code execution vulnerability affects MindsDB, particularly when using the ChromaDB, SharePoint, Weaviate, or VectorDatabase integrations. Attackers can exploit this vulnerability by crafting malicious 'INSERT' queries for list creation in SharePoint databases, or other queries containing Python code for the affected integrations. The system executes this code on the server using the unsafe eval() function, allowing unauthorized command execution and potentially compromising system integrity and confidentiality. This vulnerability falls under CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection'). The patch replaces the unsafe eval() function with ast.literal_eval(), significantly improving security by limiting evaluation to literal expressions only. This change prevents the execution of arbitrary Python code, effectively mitigating the risk of code injection attacks across all affected integrations.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://github.com/advisories/GHSA-c85f-pcx6-2ghm
• https://github.com/mindsdb/mindsdb/commit/11a4db792ad36cf704f7307c7602128b17752c80
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-45849