Remote Code Execution in berriai/litellm

The impact of CVE-2024-4264 is severe. An attacker can exploit this vulnerability by injecting malicious values into environment variables, specifically targeting the /config/update endpoint to modify settings in proxyserverconfig.yaml. Successful exploitation allows for arbitrary code execution on the server hosting the litellm instance. This could lead to data exfiltration, system takeover, and potentially lateral movement within the network if the server has access to sensitive resources. The ability to modify KMS configurations further amplifies the risk, as attackers could compromise encryption keys and decrypt sensitive data.

Organizations using litellm for LLM orchestration, particularly those leveraging Google KMS for secret management, are at significant risk. Shared hosting environments where multiple users share the same server instance are also particularly vulnerable, as an attacker could potentially exploit the vulnerability through another user's access to the /config/update endpoint.

• python / server:

import os
import re

# Check for suspicious environment variables
env_vars = os.environ
for var, value in env_vars.items():
    if re.search(r'(eval|exec|system|subprocess)', value, re.IGNORECASE):
        print(f"Suspicious environment variable detected: {var}={value}")

• linux / server:

journalctl -u litellm -f | grep -i "eval"

• generic web:

curl -I 'http://your-litellm-server/config/update' # Check for unusual headers or request parameters

1. 2024-05-18Disclosure

   disclosure

1. Reserviert2024-04-26
2. Veröffentlicht2024-05-18
3. Geändert2024-09-03
4. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2024-4264 is to upgrade to a patched version of litellm as soon as it becomes available. Until a patch is released, consider implementing temporary workarounds. Restrict access to the /config/update endpoint to trusted users only. Implement strict input validation and sanitization on all data received through this endpoint. Consider using a Web Application Firewall (WAF) to filter out potentially malicious requests containing suspicious code. Monitor system logs for unusual activity related to the /config/update endpoint and KMS interactions.