CVE-2024-5225

Advisory

Affected versions of the litellm package are vulnerable to SQL Injection attacks due to improper input sanitization. The /global/spend/logs endpoint constructs an SQL query by directly concatenating the unvalidated api_key parameter into the query string without escaping or parameterization. This allows attackers to inject arbitrary SQL code by supplying specially crafted input through the api_key parameter. Successful exploitation may lead to unauthorized data access, manipulation of database contents, exposure of sensitive information, or a Denial of Service (DoS) condition.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://github.com/advisories/GHSA-h6m6-jj8v-94jj
• https://github.com/BerriAI/litellm/commit/f75c15d6cd535aa78014378ad532de1df6be2f56
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-5225