GHSA-g5ff-637f-6q2m: Input Validation
Summary
An authenticated LiteLLM proxy user could read arbitrary local files from the proxy runtime by sending a crafted vertexaicredentials value to /utils/transformrequest. The request-body safety blocklist rejected vertexcredentials but missed its alias vertexaicredentials, which let the value reach the Vertex AI credential loader and trigger a file read that is sent to an attacker-controlled URL.
Impact
A low-privilege authenticated user (only internaluserviewer, obtainable through SSO login on many deployments) could read any file readable by the LiteLLM process. Reading files such as /proc/self/environ can disclose LITELLMMASTERKEY and provider API keys, so the impact can escalate to full proxy-admin control.
Remediation
Upgrade to 1.95.0 or later. The fix adds the missing alias to the request-body blocklist, so no configuration change is needed once you upgrade. There is no reliable configuration workaround on affected versions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/litellmto a version that resolves this vulnerability.Fixed in 1.95.0 - Upgrade
Upgrade
LiteLLMto a version that resolves this vulnerability.Fixed in 1.95.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
Affected LiteLLM proxy deployments are exposed if a user can authenticate to the proxy. A low-privilege internal_user_viewer account, which may be obtainable through SSO login in many deployments, is sufficient.
What does an attacker need to exploit it?
The attacker needs an authenticated LiteLLM proxy account and the ability to send a crafted vertex_ai_credentials value to the /utils/transform_request endpoint. No user interaction is required.
What could an attacker obtain or do after exploitation?
An attacker can read files that are readable by the LiteLLM process and have their contents sent to an attacker-controlled URL. Files such as /proc/self/environ may expose the LITELLM_MASTER_KEY and provider API keys, potentially enabling full proxy-admin control.
Is there a configuration-based mitigation if upgrading is delayed?
No reliable configuration workaround is available for affected versions. Upgrade LiteLLM to version 1.95.0 or later; the fix blocks the previously missed vertex_ai_credentials alias.