CVE-2024-6587

Nuclei

SSRF in berriai/litellm

Title source: CVE List
STIX 2.1 vulnerability

Record summary

EIP currently links 1 Nuclei template to CVE-2024-6587.

Description

A Server-Side Request Forgery (SSRF) vulnerability exists in berriai/litellm version 1.38.10. This vulnerability allows users to specify the `api_base` parameter when making requests to `POST /chat/completions`, causing the application to send the request to the domain specified by `api_base`. This request includes the OpenAI API key. A malicious user can set the `api_base` to their own domain and intercept the OpenAI API key, leading to unauthorized access and potential misuse of the API key.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Aug 22, 2024 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Sep 13, 2024 · Source: CVE List

Affected products and versions

4
ProductSourceVersion range

LiteLLM

Browse LiteLLM / LiteLLM
VulnCheckVersion data not supplied

berriai/litellm

Browse berriai / berriai/litellm
CVE ListBefore 1.44.9affected

litellm

Browse berriai / litellm

Default status: unknown

CVE ListBefore 1.44.9affected

litellm

Browse PyPI / litellm
GitHub AdvisoryBefore 1.44.8 · Fixed in 1.44.8affected

Nuclei templates

1
ProjectDiscoveryHIGHLiteLLM - Server-Side Request Forgery

LiteLLM vulnerable to Server-Side Request Forgery (SSRF) vulnerability Exposes OpenAI API Keys.

Impact

Attackers can exploit SSRF to send requests to arbitrary URLs with OpenAI API keys in the Authorization header, potentially exposing API credentials.

Remediation

Update LiteLLM to the latest version that addresses the SSRF vulnerability in the chat/completions endpoint.

Authorspdresearch, iamnoooob, rootxharsh, lambdasawa
Template tagscvecve2024ssrfopenailitellmvkevvulnai
Shodan: http.favicon.hash:439373620
https://huntr.com/bounties/4001e1a2-7b7a-4776-a3ae-e6692ec3d997 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-6587

Source: ProjectDiscovery

References

4