LiteLLM 存在远程代码执行 (Remote Code Execution, RCE) 漏洞

The vulnerability lies in the way litellm handles the 'postcallrules' configuration, which allows users to define callback functions to be executed after a chat response is processed. An attacker can exploit this by injecting a malicious callback function name. The library splits the provided value at the final '.' mark, treating the last part as the function name and appending '.py'. This allows an attacker to specify a system method, such as 'os.system', as the callback, effectively enabling arbitrary command execution when a chat response is processed. The potential impact is severe, as an attacker could gain complete control over the system running the litellm library, leading to data breaches, system compromise, and further malicious activity.

Organizations using litellm for LLM application development and deployment are at risk, particularly those relying on user-configurable 'postcallrules' for custom logic. Environments where litellm is integrated with sensitive data or critical infrastructure are especially vulnerable.

• python / supply-chain:

import os
import subprocess

# Check for suspicious post_call_rules configurations
# This is a simplified example and may need adjustments
with open('/path/to/litellm_config.py', 'r') as f:
    config_content = f.read()
    if 'os.system' in config_content:
        print('Potential CVE-2024-6825 exploitation attempt detected!')

• linux / server:

# Monitor for suspicious processes spawned by litellm
ps aux | grep -i litellm | grep -i 'os.system'

• generic web: Inspect the litellm configuration files for any unusual or unexpected callback functions in the 'postcallrules' setting.

1. 2025-03-20Disclosure

   disclosure

1. 已保留2024-07-16
2. 发布日期2025-03-20
3. 修改日期2025-10-16
4. EPSS 更新日期2026-04-02

The primary mitigation for CVE-2024-6825 is to upgrade to version v1.65.4.dev6 or later. If upgrading immediately is not feasible, consider temporarily disabling the 'postcallrules' configuration to prevent the vulnerability from being exploited. Review existing 'postcallrules' configurations for any suspicious or unexpected function names. Implement input validation and sanitization on any user-provided data used in the 'postcallrules' configuration to prevent malicious code injection. Monitor system logs for any unusual activity or command executions related to litellm.