Langroid SQLChatAgent SQL Injection Mitigation Bypass Vulnerability

A vulnerability exists in Langroid's SQLChatAgent prior to version 0.65.1, allowing SQL injection by bypassing the default SQL-injection mitigation. The issue arises because the agent's regex blocklist for dangerous SQL patterns can be evaded using PostgreSQL's schema qualification, quoted identifiers, or inline comments. This exploitation can restore access to the 'pg_read_file' function, enabling unauthorized file reads from the server. The vulnerability is present when untrusted user input can influence the SQL generated by the agent.

Impact

Exploitation of this vulnerability allows for unauthorized file reads from the PostgreSQL server, using the 'pg_read_file' function. This could lead to the disclosure of sensitive information stored in files accessible to the PostgreSQL server process.

Reproduction

The vulnerability can be reproduced by using the SQLChatAgent with a PostgreSQL database. With the 'allow_dangerous_operations' setting set to false, the agent's SQL generation can be influenced by untrusted user content. The SQLChatAgent's query validation can be bypassed by using PostgreSQL function calls that are quoted, commented, or schema-qualified, allowing the execution of functions like 'pg_read_file' that can read server-side files.

Remediation

Users are advised to update to Langroid version 0.65.1 or later, and to run SQLChatAgent with a database role that does not have permission to read server files.