A security flaw has been discovered in zhongyu09 OpenChatBI up to 0.3.0. Affected by this vulnerability is the function validatesqlsafety of the file openchatbi/text2sql/generatesql.py. Performing a manipulation results in sql injection. The attack can be initiated remotely. Versions v0.2.0 through v0.2.2 have no SQL safety validation at all, while v0.3.0 introduced a validator and v1.0.0b1/main kept the same incomplete one with an optional stricter mode. The vendor was contacted early about this disclosure but did not respond in any way.

Impact The savereport tool in openchatbi/tool/savereport.py suffers from a critical path traversal vulnerability due to insufficient input sanitization of the fileformat parameter.

The function only removes leading dots of fileformat using fileformat.lstrip(".") but allows path traversal sequences like /../../ to pass through unchanged. When the filename is constructed via string concatenation in

f"{timestamp}{cleantitle}.{fileformat}"

malicious path sequences are preserved, enabling attackers to write files outside the designated report directory.

An attacker can manipulate the LLM to call the tool with a specific fileformat to overwrite critical system files like init.py, potentially leading to remote code execution.

Patches - Affected versions: <=0.2.1 - Patched versions: 0.2.2 (includes fix from PR #12: https://github.com/zhongyu09/openchatbi/pull/12)

Workarounds No

References - Issue #10: https://github.com/zhongyu09/openchatbi/issues/10 - PR #12: https://github.com/zhongyu09/openchatbi/pull/12