Arbitrary Code Execution Vulnerability in Weaviate

CVE-2024-45846

What is CVE-2024-45846?

A vulnerability exists in the MindsDB platform specifically when the Weaviate integration is utilized. It allows for arbitrary code execution due to improper handling of user input. An attacker can exploit this by executing specially crafted 'SELECT WHERE' SQL clauses that contain Python code. When this malicious code is processed, it gets passed to the eval function on the server, resulting in the execution of arbitrary commands. This can potentially give attackers unauthorized access to sensitive information and control over the affected server environment.

References