Server-Side Request Forgery (SSRF) in vanna-ai/vanna

The SSRF vulnerability in vanna-ai/vanna poses a significant risk because it enables attackers to bypass security controls and access resources that should be protected. By crafting specific SQL queries, an attacker can manipulate DuckDB into making requests to internal services, external APIs, or even arbitrary URLs. This could lead to the exfiltration of sensitive data stored within the system, unauthorized access to internal network resources, and potentially, the launching of further attacks against other systems. The ability to read arbitrary files via read_csv and related functions expands the potential attack surface considerably, allowing attackers to potentially read configuration files or other sensitive data.

Organizations utilizing vanna-ai/vanna with DuckDB as the database backend are at risk. This includes those deploying vanna-ai/vanna in environments with sensitive data or internal systems that require protection. Shared hosting environments where multiple users share the same vanna-ai/vanna instance are particularly vulnerable.

• python / server:

import os
import subprocess
# Check for DuckDB version and potential SSRF vulnerabilities
result = subprocess.run(['duckdb', '--version'], capture_output=True, text=True)
if 'duckdb' in result.stdout.lower():
    print("DuckDB is installed. Investigate potential SSRF vulnerabilities.")

• generic web:

curl -I 'http://your-vanna-ai-instance/duckdb_ssrf_test' # Check for unexpected responses or redirects

1. 2025-03-20Disclosure

   disclosure

1. Reserviert2024-08-22
2. Veröffentlicht2025-03-20
3. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2024-8099 is to upgrade to a patched version of vanna-ai/vanna as soon as it becomes available. Until a patch is released, consider implementing temporary workarounds to limit the impact of the vulnerability. These workarounds may include restricting network access for the DuckDB instance, implementing strict input validation on SQL queries to prevent malicious commands, and utilizing a Web Application Firewall (WAF) to filter out suspicious requests. Monitor DuckDB logs for unusual activity, particularly requests to unexpected URLs. After upgrading, verify the fix by attempting to trigger the SSRF vulnerability with a known malicious query and confirming that the request is blocked or fails.