SSRF Vulnerability in litellm version 1.38.10 Leads to Unauthorized Access

CVE-2024-6587

Summary

A significant vulnerability exists in the Berriai Litellm application that enables Server-Side Request Forgery (SSRF). This flaw arises from the application allowing users to manipulate the api_base parameter during requests to the POST /chat/completions endpoint. Such manipulation facilitates the application to forward requests to an arbitrary domain defined by the user. This action can be exploited by malicious actors to intercept sensitive information, specifically the OpenAI API key included in the request. By directing the API requests to a malicious server, unauthorized access to the API key can occur, potentially leading to abuse and security breaches.

References