learner202649/CVE-2025-11203-PoC

GitHubRepository PoCScanner

PoC files

10 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a scanner that checks a LiteLLM instance for CVE-2025-11203 by querying the /health endpoint and reporting whether API keys are exposed in the response. It does not exploit the vulnerability to gain unauthorized access or exfiltrate credentials beyond what the endpoint returns.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a README, an exploit script, and a requirements file for a CVE-2025-11203 proof-of-concept. The exploit script performs only the documented information disclosure against a LiteLLM /health endpoint: it authenticates, queries the endpoint, and recursively searches the JSON response for API key fields. No backdoor, persistence, credential exfiltration to an attacker-controlled host, or unrelated payload delivery is present. The script's behavior is fully transparent and matches the stated PoC purpose.

ClassificationScanner
Model confidence95%
AuthenticationRequired
LanguagesPythonMarkdown
Target softwareLiteLLM
Attack typesInformation Disclosure
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script's primary operation is to query the /health endpoint and scan the response for exposed API keys, reporting whether a leak is detected. It does not use the leaked keys to perform any further action, such as accessing other services or escalating privileges. The README describes it as a 'Proof of Concept' but the code itself only detects and reports the presence of sensitive data, which aligns with the definition of a scanner.

exploit/exploit.py:2-7exploit/exploit.py:58-79exploit/exploit.py:134-174

Requirements

  • A valid LiteLLM API key is required to authenticate to the target instance.exploit/exploit.py:10exploit/exploit.py:44
  • The target LiteLLM instance must be reachable over the network.exploit/exploit.py:27-32

Observed behavior

  • Authenticates to the target LiteLLM instance using a provided API key.exploit/exploit.py:43-46
  • Sends a GET request to the /health endpoint and parses the JSON response.exploit/exploit.py:48-50
  • Recursively scans the response for fields named api_key, apikey, api-key, secret, token, or x-api-key and reports any found values.exploit/exploit.py:58-79
  • Prints a summary indicating whether credentials were leaked and whether the target is vulnerable or fixed.exploit/exploit.py:134-174
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Network Target
http://localhost:4000Default target for the exploit script; only connects to a user-supplied or default local address.exploit/exploit.py:185-186
Credential Search
api_key, apikey, api-key, secret, token, x-api-keyThe script searches the health endpoint JSON response for fields containing these substrings to demonstrate the information disclosure vulnerability.exploit/exploit.py:68
Review boundaries

What the analysis did not establish

  • The evidence packet reports complete_artifact_coverage as false, indicating that not all files from the repository are included. Six text files and one non-text media file are omitted from the provided content.
  • The analysis is based solely on the supplied text files (README.md, exploit/exploit.py, requirements.txt) and does not include the Docker, configuration, or documentation files referenced in the repository structure.
  • 6 unclassified files and 1 non-text media file were present in the artifact but not provided as text; their content was not reviewed.
  • The analysis scope covers only the three selected text files; the remaining 7 files (including binary and unclassified content) were not analyzed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

1
GitHub

docker-compose.yml

Created Vuln labCVE-2025-11203Compose · mixed

1 Compose manifest · 1 Dockerfile · 2 services

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment that runs a vulnerable LiteLLM instance (v1.61.0) and an optional fixed instance (v1.83.10) to demonstrate CVE-2025-11203, an information disclosure vulnerability in the /health endpoint.

docker-compose.yml:1-28README.md:1-10

Lab assessment

Vulnerability lab

The README explicitly describes the environment as a proof-of-concept for CVE-2025-11203, includes a vulnerable service, an exploit script, and a fixed service for verification.

README.md:1-10README.md:55-70
Lab shapeCompose · mixed
Services2
Compose manifests1
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

litellm-vuln

vulnerable target

A LiteLLM proxy service built from a Dockerfile that installs version 1.61.0 and patches the health check to remove 'api_key' from the illegal display parameters, causing the /health endpoint to leak configured API keys.

docker-compose.yml:4-13litellm-vuln/Dockerfile:1-11

litellm-fixed

fixed reference

A LiteLLM proxy service using a pre-built image (v1.83.10) that sanitizes API keys from the /health response, serving as a non-vulnerable comparison. It is only started when the 'fixed' profile is activated.

docker-compose.yml:16-28

exploit.py

exploit script

A Python script that authenticates to the LiteLLM /health endpoint, retrieves the response, and recursively searches for leaked API keys. It supports both vulnerable and fixed targets and provides verbose output.

exploit/exploit.py:1-199

litellm_config.yaml

configuration

A configuration file mounted into both services that defines three model entries with fake API keys, which are expected to be leaked by the vulnerable service.

litellm_config.yaml:1-16
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2025-11203

Supported by supplied evidence

The README, Dockerfile, and exploit script all explicitly reference CVE-2025-11203, describe the vulnerability (API key leak via /health in LiteLLM < 1.63.14), and provide a working proof-of-concept.

README.md:1-10litellm-vuln/Dockerfile:3-5exploit/exploit.py:1-6
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose must be installed to run the services.README.md:55-57
  • Python 3 and the 'requests' library (from requirements.txt) are needed to run the exploit script.README.md:59-60requirements.txt:1
  • The vulnerable LiteLLM service must be running and accessible at the target URL (default http://localhost:4000).README.md:55-57exploit/exploit.py:30-34
  • A valid LiteLLM master key (default 'sk-litellm-master-key') is required to authenticate to the /health endpoint.docker-compose.yml:10exploit/exploit.py:45-48

Evidence-described exercise path

  1. Start the vulnerable LiteLLM service using 'docker compose up -d'.README.md:55-57
  2. Install Python dependencies with 'pip install -r requirements.txt'.README.md:59-60
  3. Run the exploit script against the vulnerable target: 'python3 exploit/exploit.py --target http://localhost:4000 --key sk-litellm-master-key'.README.md:62-63
  4. Observe leaked API keys in the output, confirming the vulnerability.README.md:72-100
  5. (Optional) Start the fixed service with 'docker compose --profile fixed up -d' and run the exploit with '--fixed' to verify the fix.README.md:66-68
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior is directed at the contained lab target (the LiteLLM /health endpoint). The exploit script only reads from the target service and prints results; it does not modify the host, connect to external systems, persist data, or perform any destructive actions. The Docker Compose configuration uses standard port mappings and bind mounts without privileged mode, and no hidden or unnecessary behavior is present.

exploit/exploit.py:1-199docker-compose.yml:1-28
Review boundaries

What the analysis did not establish

  • The packet includes a binary file (result.png) that is not inspected; its content is unknown.
  • The Dockerfile for the vulnerable service uses a sed patch to intentionally reintroduce the vulnerability, which is a lab-specific modification and not representative of the original unpatched software behavior.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

1