Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2024-3571
CVE-2024-3571:
LangChain vulnerability analysis and mitigation
Overview
CVE-2024-3571 is a path traversal vulnerability discovered in langchain-ai/langchain's LocalFileStore functionality. The vulnerability was disclosed on April 15, 2024, affecting the LocalFileStore component of the langchain library. The issue stems from improper limitation of pathname to a restricted directory, allowing potential unauthorized access to files outside the intended directory structure (NVD).
Technical details
The vulnerability exists in the handling of file paths within the LocalFileStore's mset and mget methods. The core issue lies in insufficient path sanitization, which allows directory traversal sequences to access unintended directories. The vulnerability has been assigned a CVSS v3.0 base score of 6.5 (MEDIUM) with the vector string CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, indicating network accessibility with low attack complexity (NVD).
Impact
If exploited, this vulnerability could allow an attacker to read or write files anywhere on the filesystem, potentially leading to information disclosure or remote code execution. The impact is particularly significant as it could allow access to sensitive files outside the intended directory structure (NVD).
Mitigation and workarounds
A fix has been implemented in the langchain repository through commit aad3d8bd47d7f5598156ff2bdcc8f736f24a7412. The patch restricts the paths that can be resolved using the local file system cache, ensuring all paths must be contained within the root path. Users should update to the latest version that includes this security fix (GitHub Commit).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management