CVE-2024-8984
📋 TL;DR
This vulnerability allows unauthenticated attackers to cause a Denial of Service (DoS) by sending specially crafted HTTP requests with appended characters in multipart boundaries, leading to excessive resource consumption and service unavailability. It affects all users of berriai/litellm version v1.44.5, requiring no user interaction for exploitation.
💻 Affected Systems
- berriai/litellm
📦 What is this software?
Litellm by Litellm
Litellm by Litellm
Litellm by Litellm
Litellm by Litellm
Litellm by Litellm
⚠️ Risk & Real-World Impact
Worst Case
Complete service outage due to resource exhaustion, rendering the application unavailable to all users.
Likely Case
Intermittent service degradation or downtime from repeated exploitation attempts.
If Mitigated
Minimal impact if patched or workarounds are applied, with potential for brief disruptions.
🎯 Exploit Status
Exploitation is straightforward via crafted HTTP requests, but no public proof-of-concept is known.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after v1.44.5, specifically including the fix from commit 4f49f836aa844ac9b6bfbeff27e6f6b2b9cf3f61
Vendor Advisory: https://github.com/berriai/litellm/commit/4f49f836aa844ac9b6bfbeff27e6f6b2b9cf3f61
Restart Required: No
Instructions:
1. Update litellm to a version after v1.44.5. 2. Use pip: 'pip install --upgrade litellm'. 3. Verify the update with 'litellm --version'.
🔧 Temporary Workarounds
Input Validation Filter
allImplement server-side filtering to reject HTTP requests with malformed multipart boundaries containing appended characters.
🧯 If You Can't Patch
- Deploy a web application firewall (WAF) to block requests with suspicious multipart boundary patterns.
- Limit request size and rate-limit incoming HTTP requests to reduce resource consumption impact.
🔍 How to Verify
Check if Vulnerable:
Check if running litellm version v1.44.5; if so, it is vulnerable.Check Version:
litellm --versionVerify Fix Applied:
Confirm the version is updated to a release after v1.44.5 and test with crafted requests to ensure no DoS occurs.📡 Detection & Monitoring
Log Indicators:
- Unusual spikes in CPU/memory usage
- HTTP logs showing requests with malformed multipart boundaries (e.g., containing appended dashes)
Network Indicators:
- Increased network traffic from single sources with repeated malformed requests
SIEM Query:
source="web_logs" AND (message LIKE "%multipart boundary%" AND message LIKE "%-%-")