SQL Injection Vulnerability in berriai/litellm Repository Affects Latest Version

CVE-2024-5225

Summary

An SQL Injection vulnerability is present in the Berriai/Litellm repository, particularly impacting the /global/spend/logs endpoint. This vulnerability emerges from incorrect processing of special elements within SQL commands. It stems from the direct inclusion of an unvalidated api_key parameter into the SQL query, rendering it vulnerable to SQL injection attacks when the api_key contains malicious input. Exploitation of this flaw may allow attackers to gain unauthorized access, manipulate data, expose sensitive information, or trigger denial of service (DoS) conditions. Immediate remediation measures are essential to protect against potential security breaches stemming from this issue.

References