SQL Injection Vulnerability in Vanna-ai by the Vendor

CVE-2024-7764

What is CVE-2024-7764?

Vanna-ai v0.6.2 is susceptible to SQL Injection due to inadequate safeguards against malicious SQL command injection via user inputs. The issue originates from the generate_sql function, which invokes the extract_sql method using the response from a large language model (LLM). An attacker can exploit this vulnerability by inserting a semi-colon between valid search parameters and their own SQL command. This action can trick the extract_sql function into discarding legitimate LLM-generated SQL, resulting in the execution of arbitrary SQL commands if they are validated by the is_sql_valid function. Consequently, this flaw permits executing commands beyond the standard trained schema, raising significant security concerns.

References