CVE-2024-6587

HIGH EXPLOITED NUCLEI

berriai/litellm <1.38.10 - SSRF

Title source: llm

Description

A Server-Side Request Forgery (SSRF) vulnerability exists in berriai/litellm version 1.38.10. This vulnerability allows users to specify the `api_base` parameter when making requests to `POST /chat/completions`, causing the application to send the request to the domain specified by `api_base`. This request includes the OpenAI API key. A malicious user can set the `api_base` to their own domain and intercept the OpenAI API key, leading to unauthorized access and potential misuse of the API key.

Nuclei Templates (1)

LiteLLM - Server-Side Request Forgery
HIGHVERIFIEDby pdresearch,iamnoooob,rootxharsh,lambdasawa
Shodan: http.favicon.hash:439373620

References (2)

Scores

CVSS v3 7.5
EPSS 0.8837
EPSS Percentile 99.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Details

VulnCheck KEV 2024-08-22
CWE
CWE-918
Status published
Products (2)
litellm/litellm 1.38.10
pypi/litellm 0 - 1.44.8PyPI
Published Sep 13, 2024
Tracked Since Feb 18, 2026