OWASP GenAI Red Team Lab: LlamaIndex Orchestration Poisoning

September 18, 2026 · View on GitHub

Disclaimer & Ethical Use: This repository contains educational materials and functional proof-of-concept demonstrations designed solely for authorized security research, red team training, and defensive engineering. Unauthorized targeting or exploitation of systems without explicit written permission is strictly prohibited.

Overview

This laboratory provides a hands-on, containerized environment to analyze LlamaIndex Orchestration Poisoning (CWE-22, CWE-73, CWE-94) based on research disclosure JDP-2026-003 LlamaIndex - Path Traversal to Arbitrary File Write and RCE. Security practitioners learn how indirect prompt injections manipulate AI agent persistence tools to bypass storage boundaries, corrupt runtime integrity, and execute arbitrary code.

Quickstart

Prerequisites

  • Docker or Podman
  • Python 3.10+
  • Linux/macOS or WSL2 terminal environment

Rapid Setup

  1. Clone & Navigate: 
    git clone https://github.com/GenAI-Security-Project/GenAI-Red-Team-Lab.git
cd GenAI-Red-Team-Lab/exploitation/llamaindex
  2. Launch Interactive Trainer: 
    python3 interactive_trainer.py
  3. Automated Guided Tour: Select option [G] from the CLI menu to execute automated verification across all interactive lessons and across all four stages.

Vulnerability Profile

PropertyDetails
Research ReferenceJDP-2026-003 LlamaIndex - Path Traversal to Arbitrary File Write and RCE
Vulnerability ClassCWE-22 (Path Traversal), CWE-73 (External Control of File Name/Path), CWE-94 (Code Injection)
CVSS v3.1 Score10.0 CRITICAL (Stage 0–1 RCE: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
7.5 HIGH (Stage 0–3 DoS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H)
Primary Sink 1SimpleKVStore.persist() / StorageContext.persist() (JSON write -> Persistent DoS)
Primary Sink 2download_dataset_and_source_files() in dataset.py (Raw write -> RCE)

Multi-Stage Environment Lifecycle

The lab tracks vendor remediation across four distinct stages, illustrating supply-chain artifact drift between GitHub commits and PyPI releases:

StageTarget Dependency VersionVulnerability StatusTechnical Description
Stage 0llama-index-core==0.14.19🔴 RCE & DoS ActiveBaseline release. Dual vector: raw write in dataset.py (RCE) & JSON write in SimpleKVStore.persist() (DoS).
Stage 1llama-index-core==0.14.20🔴 PyPI Drift (RCE Active)Source commit 7049c97d deleted dataset.py on GitHub, but PyPI wheel retained it prior to merge. RCE remains active.
Stage 2llama-index-core==0.14.21🟠 RCE Closed / DoS Activedataset.py removed from PyPI wheel, closing raw RCE. Unanchored JSON persistence write remains unpatched.
Stage 3llama-index-core==0.14.21
llama-index-workflows==2.14.0		🟠 Refactor Illusion (DoS Active)Workflows added and PR #21251 merged. Core SimpleKVStore.persist() path traversal remains unpatched.

Interactive Trainer Modules

  • [1] Baseline Verification: Audit container environment status, SDK module integrity, and active stage flags.
  • [2] Path Traversal Read: Demonstrate direct filesystem traversal capabilities.
  • [3] Path Traversal Write: Execute interactive path writes outside sandbox bounds.
  • [4] Framework Overwrite (RCE): Demonstrate arbitrary Python code execution via dataset.py. (Requires Stage 0 or 1).
  • [5] Scope Change Proof: Validate payload persistence across process restarts.
  • [6] Mitigation Strategies: Evaluate path anchoring defenses (Path.resolve() and is_relative_to()).
  • [7] Custom Payload Sandbox: Construct custom indirect prompt injection strings targeting live API endpoints. (Action Type 4 RCE requires Stage 0 or 1).
  • [8] Migration Analysis: Diff vendor updates to verify missing storage patches.
  • [9] StorageContext Boundary Bypass: Exploit production StorageContext.persist() developer entry points.

Troubleshooting & Known Issues

  • Lesson 4 / Lesson 7 RCE Actions Fail: Raw code execution relies on dataset.py, which was removed from PyPI packages starting in Stage 2. Use option [S] in the CLI menu to switch to Stage 0 or Stage 1 to execute RCE modules.
  • Container State Desync: When switching stages outside the interactive script, rebuild the container without cache (docker build --no-cache ...) to ensure clean dependency states.
  • Missing dataset.py Error: This is expected behavior in Stages 2 and 3, representing the vendor's partial remediation lifecycle.

Remediation Guidelines

To prevent orchestration persistence traversal in AI agents using LlamaIndex or similar frameworks:

  1. Strict Path Anchoring: Force all persistence calls through standard boundary checks before opening file handles: 
    from pathlib import Path

def get_anchored_path(safe_root: str, user_input: str) -> Path:
    base_dir = Path(safe_root).resolve()
    target_path = (base_dir / user_input).resolve()
    if not target_path.is_relative_to(base_dir):
        raise PermissionError("Path traversal attempt detected.")
    return target_path
  2. Least Privilege Runtimes: Execute AI application containers under non-root accounts with read-only mounts over Python site-packages and system directories.

References