Listen to this Post
How the CVE Works
The vulnerability existed in the `Serializable.toJSON()` method. When LangChain serializes objects (e.g., for storage or transmission), it internally marks them with a special `’lc’` key. User-controlled data within fields like `metadata` or `additional_kwargs` was not sanitized. If an attacker injected a crafted object containing this `’lc’` key structure into such fields, the serialization process would fail to escape it. Later, during deserialization via the `load()` function, the system would mistakenly interpret the injected data as a legitimate, trusted LangChain object instead of plain user data. This confusion enabled two primary attacks: secret extraction and arbitrary class instantiation. For secret extraction, an attacker could inject a `”type”: “secret”` object pointing to an environment variable name. If the `secretsFromEnv` option was enabled (which defaulted to true), `load()` would read and return the secret value. For class instantiation, injected constructor structures could trigger the instantiation of any class available in the deserializer’s import maps with attacker-controlled parameters, potentially leading to remote code execution.
dailycve
Platform: LangChain JS
Version: < 0.2.17
Vulnerability: Serialization Injection
Severity: Critical
Date: 2024-06-19
Prediction: Patched 2024-06-19
What Undercode Say:
Simulating secret extraction attempt
cat > malicious_payload.json << 'EOF'
{"user_data": {"lc": 1, "type": "secret", "id": ["AWS_SECRET"]}}
EOF
Running the deserialization (vulnerable version)
node -e "
const { load } = require('@langchain/core/load');
process.env.AWS_SECRET = 's3cr3t';
const payload = require('./malicious_payload.json');
load(JSON.stringify(payload), { secretsFromEnv: true }).then(obj => console.log('Extracted:', obj.user_data));
"
How Exploit:
Attackers inject malicious `’lc’` key structures into user-controlled fields like LLM response `metadata` or additional_kwargs. Upon serialization and subsequent deserialization via load(), these structures are executed as code—either extracting environment variables or instantiating arbitrary classes from import maps with attacker-supplied arguments.
Protection from this CVE
Update to LangChain Core version 0.2.17+. The patch introduces escaping for `’lc’` keys in toJSON(), sets `secretsFromEnv` default to false, adds a `maxDepth` limit, and includes security warnings in JSDoc for import map options. Never populate import maps from user input.
Impact
Critical. Successful exploitation leads to sensitive environment variable disclosure (secret extraction) and arbitrary class instantiation with attacker-controlled parameters, potentially resulting in Remote Code Execution (RCE) depending on available classes in import maps. The attack requires deserializing untrusted data or trusting serialized output containing user input.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
