CVE-2024-5751: Remote Code Execution in BerriAI/litellm
BerriAI/litellm version v1.35.8 contains a vulnerability where an attacker can achieve remote code execution. The vulnerability exists in the adddeployment function, which decodes and decrypts environment variables from base64 and assigns them to os.environ. An attacker can exploit this by sending a malicious payload to the /config/update endpoint, which is then processed and executed by the server when the getsecret function is triggered. This requires the server to use Google KMS and a database to store a model.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/litellmto a version that resolves this vulnerability.Fixed in 1.40.16
Event History
Frequently Asked Questions
What is the severity of CVE-2024-5751?
CVE-2024-5751 is classified as a critical vulnerability due to the potential for remote code execution.
How do I fix CVE-2024-5751?
To fix CVE-2024-5751, upgrade litellm to version 1.40.16 or later.
What software is affected by CVE-2024-5751?
CVE-2024-5751 affects litellm version 1.35.8.
What type of vulnerability is CVE-2024-5751?
CVE-2024-5751 is a remote code execution vulnerability.
Can CVE-2024-5751 be exploited?
Yes, CVE-2024-5751 can be exploited by attackers to execute arbitrary code remotely.