CVE-2024-45851

Advisory

A critical arbitrary code execution vulnerability affects MindsDB, particularly in the ChromaDB, SharePoint, Weaviate, and VectorDatabase integrations. Attackers can exploit this vulnerability by crafting malicious queries, including 'INSERT' queries for list item creation in SharePoint databases. The system executes arbitrary Python code on the server using the unsafe eval() function when processing these queries. This flaw allows unauthorized command execution, potentially compromising system integrity and confidentiality. The vulnerability falls under CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection'). The update replaces the unsafe eval() function with ast.literal_eval(), significantly improving security by limiting evaluation to literal expressions only. This change prevents the execution of arbitrary Python code, effectively mitigating the risk of code injection attacks across all affected integrations.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://github.com/advisories/GHSA-wf9g-c67g-h4ch
• https://github.com/mindsdb/mindsdb/commit/11a4db792ad36cf704f7307c7602128b17752c80
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-45851