BerriAI LiteLLM Proxy Pre-Auth SQL Injection Scanner

MetasploitMetasploit auxiliary PoCScannerRubyauxiliary_scanner/http/litellm_proxy_sqli

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

Metasploit
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Metasploit auxiliary module that detects BerriAI LiteLLM proxy servers vulnerable to CVE-2026-42208 using a benign time-based blind SQL injection check. It sends two requests with different injected predicates and flags the target only when the first is delayed and the second is not, without reading or exfiltrating data.

Backdoor review

No backdoor observed in reviewed code

The module is a scanner for CVE-2026-42208. It performs a benign time-based SQL injection check using the framework's PostgreSQLi::TimeBasedBlind library, issues two requests (one with a tautology, one without), and reports vulnerable only when the first is delayed and the second is not. No data exfiltration, persistence, credential theft, or unrelated payload delivery is present. The code is straightforward and matches the documented purpose.

ClassificationScanner
Model confidence100%
AuthenticationNot required
Languagesruby
Target softwareBerriAI LiteLLM
Attack typessql_injection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The module's description and source code state it only detects the vulnerability using a time-based check without exploiting it to read or modify data. The check method returns a vulnerability status, and the module is classified as an auxiliary scanner in Metasploit.

modules/auxiliary/scanner/http/litellm_proxy_sqli.rb:16-17modules/auxiliary/scanner/http/litellm_proxy_sqli.rb:28-34modules/auxiliary/scanner/http/litellm_proxy_sqli.rb:127-134

Requirements

  • Target must have at least one virtual key provisioned in the token table; an empty table causes the time-based probe to fail.modules/auxiliary/scanner/http/litellm_proxy_sqli.rb:36-41

Observed behavior

  • Sends a POST request to the chat completions endpoint with an Authorization header containing a time-based blind SQL injection payload that sleeps only when a tautology is true.modules/auxiliary/scanner/http/litellm_proxy_sqli.rb:107-125
  • Sends a second request with a predicate that never sleeps, and reports the target vulnerable only if the first request is delayed while the second returns promptly.modules/auxiliary/scanner/http/litellm_proxy_sqli.rb:28-33
  • Does not read, exfiltrate, or modify data; the check is benign and crash-safe.modules/auxiliary/scanner/http/litellm_proxy_sqli.rb:28-34modules/auxiliary/scanner/http/litellm_proxy_sqli.rb:55
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

SQL Injection Probe
Bearer ' OR #{payload}-- #{Rex::Text.rand_text_alphanumeric(8)}The module constructs a time-based blind SQLi payload using the framework's create_sqli method. The payload is injected into the Authorization header to trigger pg_sleep for vulnerability detection. The random suffix defeats caching. This is the expected behavior for a CVE-2026-42208 scanner.modules/auxiliary/scanner/http/litellm_proxy_sqli.rb:107-125
Network Request
POST to TARGETURI with JSON body and crafted Authorization headerThe module sends a POST request to the configured chat completions endpoint with a minimal JSON body and the SQLi payload in the Authorization header. This is the delivery mechanism for the vulnerability check.modules/auxiliary/scanner/http/litellm_proxy_sqli.rb:114-123
Vulnerability Reporting
report_vuln with host, port, name, and refsWhen the time-based check confirms vulnerability, the module reports the finding via the Metasploit report_vuln API. This is standard auxiliary module behavior.modules/auxiliary/scanner/http/litellm_proxy_sqli.rb:144-150
Review boundaries

What the analysis did not establish

  • Only the module source and metadata are provided; framework mixins (e.g., Msf::Exploit::SQLi, PostgreSQLi::TimeBasedBlind) are not expanded, so the exact SQLi test logic is partially opaque.
  • The evidence does not include any execution output or network traffic, so the module's behavior is inferred solely from its source code and description.
  • Review is limited to the module source file; framework mixins (Msf::Exploit::SQLi, HttpClient, etc.) are not expanded, but their documented behavior is well-known and consistent with the observed usage.
  • No binary or non-text files were present in the evidence.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1