CVE-2024-25639: 
NixOS vulnerability analysis and mitigation

Khoj, an application that creates personal AI agents, disclosed a vulnerability (CVE-2024-25639) affecting its Obsidian, Desktop, and Web clients in versions prior to 1.13.0. The vulnerability was discovered and disclosed on July 8, 2024, involving inadequate sanitization of AI model responses and user inputs (GitHub Advisory).

The vulnerability stems from insufficient sanitization of AI model responses and user inputs, which can lead to Cross Site Scripting (XSS) via Prompt Injection. The issue occurs when processing untrusted documents either indexed by users or accessed through the /online command. The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (HIGH) by NVD and 5.9 (MEDIUM) by GitHub, with the vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:L. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation) and CWE-80 (Improper Neutralization of Script-Related HTML Tags in a Web Page) (NVD).

The vulnerability can enable attackers to notify themselves when their malicious document is accessed, load unexpected images into users' chat sessions, execute unwanted JavaScript causing system hangs, and potentially steal secrets from the desktop app using exposed preload.js functions. Under specific system circumstances, it could lead to potential 1-Click Remote Code Execution through HTML injection and special URI schemes (GitHub Advisory).

The vulnerability can be exploited when a user either indexes a document containing a malicious prompt or when Khoj reads an adversarial website through the /online command. The exploit requires the chat model to use the reference in its generated response text to trigger the XSS. It's worth noting that no cross-shard access is possible, and references rendered in the reference section of chat messages are not affected (GitHub Advisory).

The vulnerability has been patched in version 1.13.0 with two key fixes: implementation of DOMPurify for sanitizing rendered chat messages and addition of Content Security Policy (CSP) domain and content restrictions in the Obsidian, Desktop, and Web chat clients. Future improvements include creating and using finetuned chat LLM models to better separate Data from Instructions, addressing the root cause of prompt injection (GitHub Advisory).