CVE-2024-9606

In berriai/litellm before version 1.44.12, the `litellm/litellm_core_utils/litellm_logging.py` file contains a vulnerability where the API key masking code only masks the first 5 characters of the key. This results in the leakage of almost the entire API key in the logs, exposing a significant amount of the secret key. The issue affects version v1.44.9.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/berriai/litellm/commit/9094071c4782183e84f10630e2450be3db55509a	Patch
https://huntr.com/bounties/4a03796f-a8d4-4293-84ef-d3959456223a	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:litellm:litellm:*:*:*:*:*:*:*:*

History

07 Apr 2025, 14:50

Type	Values Removed	Values Added
Summary		(es) En berriai/litellm anteriores a la versión 1.44.12, el archivo `litellm/litellm_core_utils/litellm_logging.py` contiene una vulnerabilidad donde el código de enmascaramiento de la clave API solo enmascara los primeros 5 caracteres de la clave. Esto provoca la filtración de casi toda la clave API en los registros, exponiendo una cantidad significativa de la clave secreta. El problema afecta a la versión v1.44.9.
CPE		cpe:2.3:a:litellm:litellm::::::::
References	~~() https://github.com/berriai/litellm/commit/9094071c4782183e84f10630e2450be3db55509a -~~	() https://github.com/berriai/litellm/commit/9094071c4782183e84f10630e2450be3db55509a - Patch
References	~~() https://huntr.com/bounties/4a03796f-a8d4-4293-84ef-d3959456223a -~~	() https://huntr.com/bounties/4a03796f-a8d4-4293-84ef-d3959456223a - Exploit, Third Party Advisory
CWE		CWE-116
First Time		Litellm Litellm litellm

20 Mar 2025, 10:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-03-20 10:15

Updated : 2025-04-07 14:50

NVD link : CVE-2024-9606

Mitre link : CVE-2024-9606

CVE.ORG link : CVE-2024-9606

JSON object : View

Products Affected

litellm

litellm

CWE

CWE-117

Improper Output Neutralization for Logs

CWE-116

Improper Encoding or Escaping of Output

{"id": "CVE-2024-9606", "cveTags": [], "metrics": {"cvssMetricV30": [{"type": "Secondary", "source": "security@huntr.dev", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2025-03-20T10:15:49.443", "references": [{"url": "https://github.com/berriai/litellm/commit/9094071c4782183e84f10630e2450be3db55509a", "tags": ["Patch"], "source": "security@huntr.dev"}, {"url": "https://huntr.com/bounties/4a03796f-a8d4-4293-84ef-d3959456223a", "tags": ["Exploit", "Third Party Advisory"], "source": "security@huntr.dev"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security@huntr.dev", "description": [{"lang": "en", "value": "CWE-117"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-116"}]}], "descriptions": [{"lang": "en", "value": "In berriai/litellm before version 1.44.12, the `litellm/litellm_core_utils/litellm_logging.py` file contains a vulnerability where the API key masking code only masks the first 5 characters of the key. This results in the leakage of almost the entire API key in the logs, exposing a significant amount of the secret key. The issue affects version v1.44.9."}, {"lang": "es", "value": "En berriai/litellm anteriores a la versi\u00f3n 1.44.12, el archivo `litellm/litellm_core_utils/litellm_logging.py` contiene una vulnerabilidad donde el c\u00f3digo de enmascaramiento de la clave API solo enmascara los primeros 5 caracteres de la clave. Esto provoca la filtraci\u00f3n de casi toda la clave API en los registros, exponiendo una cantidad significativa de la clave secreta. El problema afecta a la versi\u00f3n v1.44.9."}], "lastModified": "2025-04-07T14:50:05.277", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:litellm:litellm:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "41B9404D-6FF2-4B8D-88AB-C0D6456DFA8E", "versionEndExcluding": "1.44.12"}], "operator": "OR"}]}], "sourceIdentifier": "security@huntr.dev"}