CVE-2024-4889: Code Injection in berriai/litellm
A code injection vulnerability exists in the berriai/litellm application, version 1.34.6, due to the use of unvalidated input in the eval function within the secret management system. This vulnerability requires a valid Google KMS configuration file to be exploitable. Specifically, by setting the UILOGOPATH variable to a remote server address in the getimage function, an attacker can write a malicious Google KMS configuration file to the cachedlogo.jpg file. This file can then be used to execute arbitrary code by assigning malicious code to the SAVECONFIGTODB environment variable, leading to full system control. The vulnerability is contingent upon the use of the Google KMS feature.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
berriai/litellmto a version that resolves this vulnerability.Fixed in 1.34.6 - Configuration
Do not set UI_LOGO_PATH to a remote server address; ensure it cannot point to attacker-controlled remote content in the get_image function.
berriai/litellm secret management system (get_image) UI_LOGO_PATH = Unset or set to a local/verified path only (no remote server address) - Configuration
Disable the Google KMS feature when not needed, since exploitation is contingent upon using the Google KMS feature and requires a valid Google KMS configuration file.
berriai/litellm secret management system Google KMS feature = Disable if not required - Configuration
Prevent attackers from influencing SAVE_CONFIG_TO_DB, since malicious assignment can lead to arbitrary code execution and full system control after the malicious cached_logo.jpg is created.
berriai/litellm secret management system SAVE_CONFIG_TO_DB = Ensure unset/disabled and only set via trusted, validated configuration
Event History
Frequently Asked Questions
What is the severity of CVE-2024-4889?
CVE-2024-4889 has a high severity rating due to its potential for code injection attacks.
How do I fix CVE-2024-4889?
To fix CVE-2024-4889, ensure that all user inputs are validated before being processed by the eval function.
What is the affected version for CVE-2024-4889?
CVE-2024-4889 affects the berriai/litellm application version 1.34.6 up to, but not including, version 1.44.16.
What type of vulnerability is CVE-2024-4889?
CVE-2024-4889 is a code injection vulnerability resulting from the use of unvalidated input.
Is a specific configuration needed to exploit CVE-2024-4889?
Yes, a valid Google KMS configuration file is required to exploit CVE-2024-4889.