CVE-2024-6587

Advisory

A Server-Side Request Forgery (SSRF) vulnerability affects berriai/litellm affected versions, including the proxy authentication module. Attackers can exploit this vulnerability by manipulating the api_base or base_url parameters in request bodies sent to POST /chat/completions. This allows malicious users to redirect API calls to attacker-controlled domains, intercepting sensitive information such as OpenAI API keys. The vulnerability enables unauthorized access and potential misuse of the intercepted API keys. The patch implements strict input validation, rejecting requests containing these dangerous parameters.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://huntr.com/bounties/4001e1a2-7b7a-4776-a3ae-e6692ec3d997
• https://github.com/advisories/GHSA-g26j-5385-hhw3
• https://github.com/BerriAI/litellm/commit/ba1912afd1b19e38d3704bb156adf887f91ae1e0
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-6587