CVE-2024-6825
📋 TL;DR
This vulnerability in BerriAI/litellm allows remote code execution by exploiting improper input validation in the 'post_call_rules' configuration. Attackers can inject system commands that execute when chat responses are processed. Any system running vulnerable versions of litellm with exposed configuration interfaces is affected.
💻 Affected Systems
- BerriAI/litellm
📦 What is this software?
Litellm by Litellm
Litellm by Litellm
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise allowing attacker to execute arbitrary commands with the privileges of the litellm process, potentially leading to data theft, ransomware deployment, or complete system takeover.
Likely Case
Unauthorized command execution leading to data exfiltration, installation of backdoors, or lateral movement within the network.
If Mitigated
Limited impact if proper network segmentation and least privilege principles are followed, though command execution would still be possible.
🎯 Exploit Status
Exploitation requires ability to modify configuration settings, which may require authentication depending on deployment.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.40.13 and later
Vendor Advisory: https://github.com/berriai/litellm/commit/441c7275ed2715f47650a7c2e525055c804073a9
Restart Required: No
Instructions:
1. Update litellm to version 1.40.13 or later using pip: pip install --upgrade litellm>=1.40.13
2. Verify the update completed successfully
3. No restart required as this is a library update
🔧 Temporary Workarounds
Restrict configuration access
allLimit who can modify litellm configuration settings, especially 'post_call_rules'
Input validation wrapper
allImplement additional validation layer for configuration inputs before passing to litellm
🧯 If You Can't Patch
- Implement strict access controls on configuration interfaces
- Deploy network segmentation to isolate litellm instances from sensitive systems
🔍 How to Verify
Check if Vulnerable:
Check litellm version: python -c "import litellm; print(litellm.__version__)" - if version is 1.40.12 or earlier, system is vulnerable.Check Version:
python -c "import litellm; print(litellm.__version__)"Verify Fix Applied:
After update, verify version is 1.40.13 or later using same command.📡 Detection & Monitoring
Log Indicators:
- Unusual system command execution from litellm process
- Configuration changes to 'post_call_rules' with suspicious values
- Error logs showing import failures for unexpected modules
Network Indicators:
- Outbound connections from litellm to unexpected destinations
- Command and control traffic patterns
SIEM Query:
process_name:"python" AND process_command_line:"*litellm*" AND (process_command_line:"*os.system*" OR process_command_line:"*subprocess*" OR process_command_line:"*eval*")