CVE-2024-5751
📋 TL;DR
This vulnerability allows remote code execution in BerriAI/litellm when an attacker sends a malicious payload to the /config/update endpoint. The vulnerability occurs when environment variables are improperly decoded and assigned to os.environ, enabling arbitrary code execution. Systems using litellm v1.35.8 with Google KMS and database storage for models are affected.
💻 Affected Systems
- BerriAI/litellm
📦 What is this software?
Litellm by Litellm
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining full control over the server, allowing data theft, lateral movement, and persistent backdoor installation.
Likely Case
Attacker executes arbitrary commands on the server, potentially accessing sensitive data, modifying configurations, or disrupting services.
If Mitigated
Limited impact with proper input validation and environment isolation preventing successful exploitation.
🎯 Exploit Status
Exploitation requires access to the /config/update endpoint and specific configuration conditions.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v1.35.9 or later
Vendor Advisory: https://huntr.com/bounties/ae623c2f-b64b-4245-9ed4-f13a0a5824ce
Restart Required: Yes
Instructions:
1. Update litellm to version v1.35.9 or later using pip install --upgrade litellm==1.35.9
2. Restart all litellm services
3. Verify the update with pip show litellm
🔧 Temporary Workarounds
Disable vulnerable endpoint
allBlock or disable access to the /config/update endpoint
Configure firewall rules to block /config/update endpoint
Modify application routing to disable this endpoint
Input validation
allImplement strict input validation for environment variable decoding
Add validation checks in add_deployment function before os.environ assignment
🧯 If You Can't Patch
- Implement network segmentation to isolate litellm instances from critical systems
- Deploy web application firewall with RCE protection rules
🔍 How to Verify
Check if Vulnerable:
Check if running litellm version v1.35.8 and configured with Google KMS and database model storageCheck Version:
pip show litellm | grep VersionVerify Fix Applied:
Verify litellm version is v1.35.9 or later and test /config/update endpoint with safe payloads📡 Detection & Monitoring
Log Indicators:
- Unusual requests to /config/update endpoint
- Base64 encoded payloads in request logs
- Unexpected environment variable modifications
Network Indicators:
- POST requests to /config/update with encoded payloads
- Unusual outbound connections from litellm server
SIEM Query:
source="web_logs" AND uri_path="/config/update" AND (payload_contains="base64" OR payload_size>1000)