CVE-2024-8953
📋 TL;DR
This vulnerability allows remote code execution through the mathematical_calculator endpoint in composiohq/composio version 0.4.3. Attackers can execute arbitrary code by passing malicious input to the unsafe eval() function. Anyone using the vulnerable version of this software is affected.
💻 Affected Systems
- composiohq/composio
📦 What is this software?
Composio by Composio
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attackers to execute arbitrary commands, steal data, install malware, or pivot to other systems.
Likely Case
Remote code execution leading to data exfiltration, service disruption, or lateral movement within the network.
If Mitigated
Limited impact if input validation and sanitization are properly implemented before reaching the eval() function.
🎯 Exploit Status
Exploitation is straightforward due to the direct use of eval() with user input.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.4.4 or later
Vendor Advisory: https://huntr.com/bounties/8203d721-e05f-4500-a5bc-c0bec980420c
Restart Required: Yes
Instructions:
1. Check current version: pip show composio
2. Upgrade: pip install --upgrade composio>=0.4.4
3. Restart the application/service
🔧 Temporary Workarounds
Disable mathematical_calculator endpoint
allTemporarily disable or block access to the vulnerable endpoint
Configure web server/application firewall to block /mathematical_calculator endpoint
Input validation filter
allImplement strict input validation to only allow mathematical expressions
Add regex validation: ^[0-9\+\-\*\/\(\)\.\s]+$
🧯 If You Can't Patch
- Implement strict input validation and sanitization before eval()
- Use a safe math evaluation library instead of eval()
🔍 How to Verify
Check if Vulnerable:
Check if composio version is 0.4.3 and mathematical_calculator endpoint is accessibleCheck Version:
pip show composio | grep VersionVerify Fix Applied:
Verify version is 0.4.4 or later and test endpoint with safe mathematical input only📡 Detection & Monitoring
Log Indicators:
- Unusual eval() errors
- Suspicious mathematical_calculator endpoint requests with non-numeric characters
- System command execution in logs
Network Indicators:
- Requests to /mathematical_calculator with encoded payloads
- Outbound connections from composio process to unexpected destinations
SIEM Query:
source="composio" AND (endpoint="/mathematical_calculator" AND NOT input~"^[0-9+\-*/()\s.]*$")