Arbitrary File Write by Prompt Injection via DuckDB SQL in vanna-ai/vanna

The impact of CVE-2024-5827 is severe. An attacker can leverage SQL injection to inject malicious training data into Vanna AI's DuckDB database. This injected data can then be used to generate SQL queries that write arbitrary files to the victim's file system. The description explicitly mentions the creation of a backdoor file (backdoor.php) containing PHP code that allows for remote command execution via system($_GET[0]);. This effectively grants the attacker complete control over the affected system. The blast radius extends to any system running a vulnerable version of Vanna AI and exposed to external network access.

Organizations and individuals deploying Vanna AI in production environments, particularly those exposing the Flask Web APIs to external networks, are at significant risk. Shared hosting environments where multiple users share the same server instance are also vulnerable, as a compromised Vanna AI instance could potentially impact other users on the same server.

• python / server:

import os
import subprocess
# Check for suspicious files
suspect_files = ['/tmp/backdoor.php', '/var/www/backdoor.php']
for file in suspect_files:
    if os.path.exists(file):
        print(f"Suspicious file found: {file}")
        # Further investigation needed

• linux / server:

# Check for recently created PHP files in web directories
find /var/www/ -name '*.php' -mtime -1
# Monitor DuckDB query logs for suspicious SQL injection attempts
# (Requires configuring DuckDB logging)

1. 2024-06-28Disclosure

   disclosure

1. आरक्षित2024-06-10
2. प्रकाशित2024-06-28
3. संशोधित2025-10-15
4. EPSS अद्यतन2026-04-02

The primary mitigation for CVE-2024-5827 is to upgrade to a patched version of Vanna AI as soon as it becomes available. Until a patch is released, consider implementing temporary workarounds. Input validation and sanitization on all user-supplied data used in SQL queries is crucial. Restrict network access to the Vanna AI Flask Web APIs to only trusted sources. Monitor file system activity for unexpected file creations, particularly in sensitive directories. Implement a Web Application Firewall (WAF) with rules to detect and block SQL injection attempts targeting the DuckDB integration.