LangChain Arbitrary Command Execution - CVE-2023-34541

Vulnerability Introduction

LangChain is a framework for developing applications driven by language models.

In the affected version of LangChain, because the load_prompt function does not perform security filtering on the loaded content when loading the prompt file, an attacker can induce users to load the file by constructing a prompt file containing malicious commands, which can cause arbitrary system commands to be executed.

Vulnerability Recurrence

Write under project test.py

from  langchain . prompts  import  load_prompt 
if  __name__  ==  '__main__' : loaded_prompt = load_prompt ( "system.py" )
      

system.py Write and execute system commands  in the same directory dir

import  os 
os . system ( "dir" )

Run  test.py returns dir the result of executing a system command

Vulnerability Analysis:-_load_prompt_from_file

langchain.prompts.loading.load_prompt

try_load_from_hub is trying to remotely load a file from a given path but because we are loading a local file, the next step is to jump to _load_prompt_from_file

langchain.prompts.loading._load_prompt_from_file

That is to say, the code can be abbreviated as

if  __name__  ==  '__main__' : file_path = "system.py" with open ( file_path , "rb" ) as f : exec ( f . read ())
      

Vulnerability Analysis:- try_load_from_hub

Because of the network, there has been no way to reproduce the success, here is a detailed analysis of the code level

from  langchain.prompts import load_prompt _ _  

if  __name__  ==  '__main__' : loaded_prompt = load_prompt ( "lc://prompts/../../../../../../../system.py" )
      

langchain.prompts.loading.load_prompt

langchain.utilities.loading.try_load_from_hub

It is matched first  HUB_PATH_RE = re.compile(r"lc(?Pref@[^:]+)?://(?Ppath.*)"), so the need to satisfy the initial is lc://

Then match the following content, requiring the value of the first field to be  prompts the last suffix  {'py', 'yaml', 'json'}in

Support Links