CVE-2024-6587
📋 TL;DR
This SSRF vulnerability in berriai/litellm allows attackers to redirect API requests to malicious servers, exposing OpenAI API keys. Any application using the vulnerable version of litellm with user-controlled api_base parameters is affected. The vulnerability enables API key theft and unauthorized API usage.
💻 Affected Systems
- berriai/litellm
📦 What is this software?
Litellm by Litellm
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of OpenAI API keys leading to unauthorized API usage, financial loss from API abuse, and potential data exfiltration from connected services.
Likely Case
API key theft enabling unauthorized API calls, resulting in unexpected charges and potential service disruption.
If Mitigated
Limited impact if proper input validation and network segmentation prevent external SSRF requests.
🎯 Exploit Status
Exploit requires ability to send requests to the vulnerable endpoint with controlled api_base parameter.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.38.11 and later
Vendor Advisory: https://github.com/berriai/litellm/commit/ba1912afd1b19e38d3704bb156adf887f91ae1e0
Restart Required: Yes
Instructions:
1. Update litellm to version 1.38.11 or later using pip install --upgrade litellm. 2. Restart any services using litellm. 3. Verify the fix by checking the version.
🔧 Temporary Workarounds
Input Validation
allImplement strict validation to only allow trusted domains in api_base parameter
Network Segmentation
allRestrict outbound network access from litellm instances to only required OpenAI endpoints
🧯 If You Can't Patch
- Implement strict input validation to reject user-controlled api_base parameters
- Monitor API usage and set up alerts for unusual API key usage patterns
🔍 How to Verify
Check if Vulnerable:
Check if using litellm version 1.38.10 or earlier and if api_base parameter accepts user inputCheck Version:
pip show litellm | grep VersionVerify Fix Applied:
Verify litellm version is 1.38.11 or later and test that api_base parameter validation is enforced📡 Detection & Monitoring
Log Indicators:
- Unusual outbound requests from litellm to non-OpenAI domains
- Multiple failed API key validations
- Unexpected api_base parameter values in request logs
Network Indicators:
- Outbound HTTP requests from litellm to unexpected domains
- Traffic patterns showing API calls to non-standard endpoints
SIEM Query:
source="litellm" AND (api_base NOT CONTAINS "api.openai.com" OR destination_ip NOT IN [OpenAI_IPs])