SSRF Vulnerability in litellm version 1.38.10 Leads to Unauthorized Access

CVE-2024-6587

What is CVE-2024-6587?

A significant vulnerability exists in the Berriai Litellm application that enables Server-Side Request Forgery (SSRF). This flaw arises from the application allowing users to manipulate the api_base parameter during requests to the POST /chat/completions endpoint. Such manipulation facilitates the application to forward requests to an arbitrary domain defined by the user. This action can be exploited by malicious actors to intercept sensitive information, specifically the OpenAI API key included in the request. By directing the API requests to a malicious server, unauthorized access to the API key can occur, potentially leading to abuse and security breaches.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References