Listen to this Post
The vulnerability in LangChain’s f-string template system stemmed from improper validation of user-supplied template strings. The `string.Formatter().parse()` method extracted full field expressions, including attribute access syntax like {msg.__class__}. While method calls `()` were blocked, attribute `.` and indexing `[]` operations were permitted. This allowed an attacker who controlled the template structure, not just the variables, to traverse object attributes. By chaining accesses, for example from a chat message object to its `__class__` and then to __globals__, an attacker could reach the `os` module and subsequently access environment variables via dictionary indexing
[__import__]('os').environ</code>, leading to sensitive information disclosure.
Platform: LangChain-core
Version: Pre-0.1.0 (patched)
Vulnerability: Template Injection
Severity: Critical
date: 2024-XX-XX
<h2 style="color: blue;">Prediction: Patch released.</h2>
<h2 style="color: blue;">What Undercode Say:</h2>
[bash]
pip list | grep langchain-core
from string import Formatter
template = "{msg.<strong>class</strong>}"
print([var_name for (_, var_name, _, _) in Formatter().parse(template)])
Output: ['msg.<strong>class</strong>']
Exploitable code pattern
malicious_template = ChatPromptTemplate.from_messages(
[("human", "{msg.<strong>globals</strong>[bash]<a href="'os'"><strong>import</strong></a>.environ}")],
template_format="f-string"
)
How Exploit:
Attacker controls template string input. They inject a payload using attribute access and indexing to traverse from a passed object to `__globals__` and `os.environ` to leak secrets.
Protection from this CVE:
Update langchain-core. Use hardcoded templates. Avoid Jinja2 for untrusted sources. Prefer direct message objects.
Impact:
Sensitive data disclosure via environment variable access. Potential remote code execution precursor.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
