CVE-2024-5225: SQL Injection in berriai/litellm
An SQL Injection vulnerability exists in the berriai/litellm repository, specifically within the /global/spend/logs endpoint. The vulnerability arises due to improper neutralization of special elements used in an SQL command. The affected code constructs an SQL query by concatenating an unvalidated apikey parameter directly into the query, making it susceptible to SQL Injection if the apikey contains malicious data. This issue affects the latest version of the repository. Successful exploitation of this vulnerability could lead to unauthorized access, data manipulation, exposure of confidential information, and denial of service (DoS).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/litellmto a version that resolves this vulnerability.Fixed in 1.40.0
Event History
Frequently Asked Questions
What is the severity of CVE-2024-5225?
CVE-2024-5225 is classified as a high severity vulnerability due to its potential for exploitation through SQL injection.
How do I fix CVE-2024-5225?
To fix CVE-2024-5225, update the litellm package to version 1.40.2 or later, which includes necessary security patches.
Who is affected by CVE-2024-5225?
CVE-2024-5225 affects users of the litellm package versions prior to 1.40.2 when using the /global/spend/logs endpoint.
What kind of attack does CVE-2024-5225 allow?
CVE-2024-5225 allows attackers to execute arbitrary SQL commands via crafted input, leading to unauthorized data access.
Is CVE-2024-5225 still exploitable?
CVE-2024-5225 is exploitable in versions of the litellm package below 1.40.2 until they are patched or updated.