Arbitrary File Deletion Vulnerability in BerriAI's littellm

CVE-2024-4888

What is CVE-2024-4888?

BerriAI's litellm suffers from a significant vulnerability that allows for arbitrary file deletion due to inadequate input validation on the /audio/transcriptions endpoint. By crafting a malicious request that specifies a file path, an attacker can exploit this flaw to delete any file on the server, bypassing necessary authorization checks. The vulnerability stems from the improper use of the os.remove(file.filename) function, enabling unauthorized users to erase sensitive files, including SSH keys, SQLite databases, and configuration files. This poses a considerable risk to the integrity and security of the affected systems.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References