Path Traversal in LangSmith Client SDKs

Executive Summary

This vulnerability exists in LangSmith Client SDKs prior to version 0.8.18, specifically in the TracingMiddleware component. An attacker who can send an HTTP request to a server running this middleware can cause the server to read an arbitrary file from its local filesystem and upload the file contents as a trace attachment to LangSmith.

The attack can be triggered without authentication depending on how the distributed trace system is deployed. However, to retrieve the uploaded file contents, the attacker must have read access to the LangSmith workspace where the traces are stored.

The vulnerability arises from two main issues: one allows injection of run attributes including attachments through a tracing-propagation header without proper validation, and the other is a failed type check that was intended to prevent unauthorized filesystem access. This combination enables an attacker to specify any file to be read and uploaded by the server's tracing thread.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability allows an attacker with HTTP access to a server running the vulnerable LangSmith TracingMiddleware to cause that server to read and upload arbitrary files from its local filesystem.

While triggering the file read may not require authentication, retrieving the file contents requires read access to the LangSmith workspace. This means that low-privilege workspace members, contractors, or compromised accounts with trace-read permissions can gain unauthorized access to sensitive files on the server.

This results in a trust-boundary crossing where parties with limited workspace permissions can access server files outside the intended security boundary, potentially exposing sensitive or confidential information.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for unusual HTTP requests sent to servers running the LangSmith SDK's TracingMiddleware that attempt to trigger arbitrary file reads. Specifically, look for HTTP requests containing tracing-propagation headers with injected run attributes or attachments that could indicate an attempt to exploit the path traversal flaw.

Since the vulnerability involves an attacker sending HTTP requests to trigger file reads, network traffic analysis tools or web server logs can be inspected for suspicious requests targeting the tracing middleware endpoints.

There are no explicit commands provided in the resources, but general detection steps could include:

• Using tools like curl or wget to simulate suspicious HTTP requests to the TracingMiddleware endpoint to see if arbitrary file reads are possible (only in a controlled test environment).
• Checking web server or application logs for HTTP requests with unusual headers or parameters related to tracing propagation.
• Using network monitoring tools (e.g., tcpdump, Wireshark) to capture and analyze HTTP traffic for suspicious requests targeting the tracing middleware.

Useful 0 Not Useful 0

Mitigation Strategies

The primary immediate mitigation step is to upgrade the LangSmith SDK to version 0.8.18 or later, where this vulnerability is fixed.

Until the upgrade can be applied, it is recommended to avoid exposing the TracingMiddleware to untrusted HTTP traffic to prevent attackers from triggering arbitrary file reads.

Additionally, limit workspace trace-read access to trusted members only, as retrieving the file contents requires read access to the LangSmith workspace where traces are sent.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows an attacker with workspace trace-read access to read arbitrary files from any server running the vulnerable LangSmith TracingMiddleware, potentially exposing sensitive data outside the intended trust boundary.

Such unauthorized access and potential data exposure could lead to non-compliance with data protection regulations like GDPR and HIPAA, which require strict controls over access to personal and sensitive information.

Organizations using affected versions should mitigate the risk by upgrading to version 0.8.18 or later, restricting workspace trace-read access to trusted members, and avoiding exposure of TracingMiddleware to untrusted HTTP traffic to maintain compliance.

Useful 0 Not Useful 0