CVE-2024-4889

A code injection vulnerability exists in the berriai/litellm application, version 1.34.6, due to the use of unvalidated input in the eval function within the secret management system. This vulnerability requires a valid Google KMS configuration file to be exploitable. Specifically, by setting the `UI_LOGO_PATH` variable to a remote server address in the `get_image` function, an attacker can write a malicious Google KMS configuration file to the `cached_logo.jpg` file. This file can then be used to execute arbitrary code by assigning malicious code to the `SAVE_CONFIG_TO_DB` environment variable, leading to full system control. The vulnerability is contingent upon the use of the Google KMS feature.

CVSS v3 7.2 HIGH

7.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://huntr.com/bounties/be3fda72-a65b-4993-9a0e-7e0f05db51f8	Exploit Third Party Advisory
https://huntr.com/bounties/be3fda72-a65b-4993-9a0e-7e0f05db51f8	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:litellm:litellm:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2024-06-06 18:15

Updated : 2024-11-21 09:43

NVD link : CVE-2024-4889

Mitre link : CVE-2024-4889

CVE.ORG link : CVE-2024-4889

JSON object : View

Products Affected

litellm

litellm

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2024-4889", "cveTags": [], "metrics": {"cvssMetricV30": [{"type": "Secondary", "source": "security@huntr.dev", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}]}, "published": "2024-06-06T18:15:18.577", "references": [{"url": "https://huntr.com/bounties/be3fda72-a65b-4993-9a0e-7e0f05db51f8", "tags": ["Exploit", "Third Party Advisory"], "source": "security@huntr.dev"}, {"url": "https://huntr.com/bounties/be3fda72-a65b-4993-9a0e-7e0f05db51f8", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security@huntr.dev", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "A code injection vulnerability exists in the berriai/litellm application, version 1.34.6, due to the use of unvalidated input in the eval function within the secret management system. This vulnerability requires a valid Google KMS configuration file to be exploitable. Specifically, by setting the `UI_LOGO_PATH` variable to a remote server address in the `get_image` function, an attacker can write a malicious Google KMS configuration file to the `cached_logo.jpg` file. This file can then be used to execute arbitrary code by assigning malicious code to the `SAVE_CONFIG_TO_DB` environment variable, leading to full system control. The vulnerability is contingent upon the use of the Google KMS feature."}, {"lang": "es", "value": "Existe una vulnerabilidad de inyecci\u00f3n de c\u00f3digo en la aplicaci\u00f3n berriai/litellm, versi\u00f3n 1.34.6, debido al uso de entradas no validadas en la funci\u00f3n de evaluaci\u00f3n dentro del sistema de gesti\u00f3n de secretos. Esta vulnerabilidad requiere un archivo de configuraci\u00f3n de Google KMS v\u00e1lido para ser explotable. Espec\u00edficamente, al configurar la variable `UI_LOGO_PATH` en una direcci\u00f3n de servidor remoto en la funci\u00f3n `get_image`, un atacante puede escribir un archivo de configuraci\u00f3n malicioso de Google KMS en el archivo `cached_logo.jpg`. Este archivo luego se puede usar para ejecutar c\u00f3digo arbitrario asignando c\u00f3digo malicioso a la variable de entorno `SAVE_CONFIG_TO_DB`, lo que lleva al control total del sistema. La vulnerabilidad depende del uso de la funci\u00f3n Google KMS."}], "lastModified": "2024-11-21T09:43:47.970", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:litellm:litellm:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C90542D4-7994-47FF-8394-D537FCF72331", "versionEndExcluding": "1.44.16"}], "operator": "OR"}]}], "sourceIdentifier": "security@huntr.dev"}