« Volver al listado

CVE-2024-7042

Estado: AnalizadaCrítica (9.8)—

A vulnerability in the GraphCypherQAChain class of langchain-ai/langchainjs versions 0.2.5 and all versions with this class allows for prompt injection, leading to SQL injection. This vulnerability permits unauthorized data manipulation, data exfiltration, denial of service (DoS) by deleting all data, breaches in multi-tenant security environments, and data integrity issues. Attackers can create, update, or delete nodes and relationships without proper authorization, extract sensitive data, disrupt services, access data across different tenants, and compromise the integrity of the database.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vector CVSS AV:N/AC:L/PR:N indica explotación remota sin autenticación (T1190). Inyección de prompts en GraphCypherQAChain permite lectura (T1005), manipulación (T1565.001) y DoS por eliminación de datos (T1499.004). CWE-89 confirma inyección SQL.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Filter Network TrafficVulnerability ScanningRestrict File and Directory PermissionsPrivileged Account ManagementRemote Data StorageNetwork Segmentation

Tecnologías afectadas (1)

Langchain — Langchain

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-7042",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-7042",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-10-29T13:50:49.711929Z"
        }
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Secondary",
        "source": "security@huntr.dev",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 4.9,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 3.4,
        "exploitabilityScore": 1.4
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security@huntr.dev",
      "affectedData": [
        {
          "vendor": "langchain-ai",
          "product": "langchain-ai/langchainjs",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "0.3.1",
              "versionType": "custom"
            }
          ]
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:langchain-ai:langchainjs:*:*:*:*:*:*:*:*"
          ],
          "vendor": "langchain-ai",
          "product": "langchainjs",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "0.3.1",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-10-29T13:15:08.883",
  "references": [
    {
      "url": "https://github.com/langchain-ai/langchainjs/commit/615b9d9ab30a2d23a2f95fb8d7acfdf4b41ad7a6",
      "tags": [
        "Patch"
      ],
      "source": "security@huntr.dev"
    },
    {
      "url": "https://huntr.com/bounties/b612defb-1104-4fff-9fef-001ab07c7b2d",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "security@huntr.dev"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@huntr.dev",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability in the GraphCypherQAChain class of langchain-ai/langchainjs versions 0.2.5 and all versions with this class allows for prompt injection, leading to SQL injection. This vulnerability permits unauthorized data manipulation, data exfiltration, denial of service (DoS) by deleting all data, breaches in multi-tenant security environments, and data integrity issues. Attackers can create, update, or delete nodes and relationships without proper authorization, extract sensitive data, disrupt services, access data across different tenants, and compromise the integrity of the database."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad en la clase GraphCypherQAChain de langchain-ai/langchainjs versiones 0.2.5 y todas las versiones con esta clase permite la inyección rápida, lo que lleva a la inyección SQL. Esta vulnerabilidad permite la manipulación no autorizada de datos, la exfiltración de datos, la denegación de servicio (DoS) mediante la eliminación de todos los datos, las infracciones en entornos de seguridad de múltiples tenants y los problemas de integridad de los datos. Los atacantes pueden crear, actualizar o eliminar nodos y relaciones sin la autorización adecuada, extraer datos confidenciales, interrumpir servicios, acceder a datos en diferentes tenants y comprometer la integridad de la base de datos."
    }
  ],
  "lastModified": "2026-06-17T08:19:15.130",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:langchain:langchain:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "46A65E02-4E54-49B9-942F-BDD1555CCA4B",
              "versionEndExcluding": "0.3.1"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@huntr.dev"
}