AkariAsai Self-RAG Unsafe Pickle Deserialization Vulnerability Allowing Arbitrary Code Execution

A vulnerability in AkariAsai Self-RAG versions up to commit 1fcdc420e48f50a7d7ab1ece5494221b93252e99 allows for arbitrary code execution through unsafe deserialization of index metadata. The issue arises in the retrieval_lm component, specifically within the Indexer.deserialize_from function in index.py. The vulnerability can be exploited remotely by manipulating the index_meta.faiss argument, leading to unauthorized code execution.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the server where Self-RAG is running, with the same privileges as the user executing the process. This could also enable an attacker to steal local credentials such as API keys or model tokens, and potentially poison retriever artifacts used in downstream Retrieval-Augmented Generation (RAG) tasks.

Reproduction

The vulnerability can be reproduced by loading a cached retriever index from a directory that has been polluted with a maliciously crafted index_meta.faiss file. This can be done by enabling the --save_or_load_index option, which triggers the deserialization of the index metadata from an untrusted source using pickle. The deserialized data is then used by the retriever, allowing any embedded code to execute.

Remediation

The suggested remediation is to avoid using pickle for deserializing retriever index metadata. Instead, store the metadata in a safe format such as JSON or CSV, and implement integrity checks like a signed manifest or checksum verification against a trusted source.