Scenario 04: Vector Database PII Extraction¶

Difficulty: Intermediate Time: ~20 minutes Prerequisites: Complete Scenario 01 Target: ailab-ml:8000 (ChromaDB), ailab-ds:6333 (Qdrant)

Background¶

Vector databases store embeddings alongside their source documents. When used for RAG (Retrieval Augmented Generation), they often contain full-text chunks from sensitive documents — internal wikis, customer data, financial records, PII. Unlike traditional databases, vector stores are optimized for similarity search and rarely have row-level access controls.

Objective¶

Extract stored documents and PII from ChromaDB and Qdrant vector databases.

Commands¶

# Exploit ChromaDB on the ML platform host
aipostex vectordb --type chromadb --target 172.16.50.20:8000 search-sensitive

# Exploit Qdrant on the data science host
aipostex vectordb --type qdrant --target 172.16.50.30:6333 search-sensitive

Expected Finding¶

ChromaDB (ailab-ml:8000): - Collection listing reveals RAG document stores - Stored documents contain PII: names, email addresses, internal project details - API keys embedded in document metadata

Qdrant (ailab-ds:6333): - Points (stored vectors) contain payload data with sensitive content - Collection metadata reveals purpose (e.g., "customer-support-embeddings")

Example finding:

{
  "finding_type": "sensitive_data",
  "service": "chromadb",
  "detail": "PII found in stored documents",
  "sample": "Customer: John Smith, email: jsmith@acme.corp..."
}

Scoring objective: At least one ChromaDB collection and one Qdrant collection contain extractable PII or credentials.

Real-World Impact¶

Vector databases are the hidden data store behind every RAG application. They often contain full-text copies of documents that were never meant to be directly accessible. Attackers who access a ChromaDB or Qdrant instance can reconstruct entire document sets, extract PII at scale, and understand an organization's proprietary knowledge base.

Follow-On¶

Scenario 07: Poison these vector stores to manipulate RAG outputs
Scenario 12: Use extracted PII as part of a multi-vector campaign