CVE-2024-5751

Improper Control of Generation of Code ('Code Injection') (CWE-94)

Published: Jun 27, 2024 / Updated: 4mo ago

BerriAI/litellm version v1.35.8 contains a vulnerability where an attacker can achieve remote code execution. An attacker can exploit this by sending a malicious payload to the /config/update endpoint, which is then processed and executed by the server when the get_secret function is triggered.

BerriAI/litellm version v1.35.8 contains a vulnerability where an attacker can achieve remote code execution. An attacker can exploit this by sending a malicious payload to the /config/update endpoint, which is then processed and executed by the server when the get_secret function is triggered.

CVE ID : CVE-2024-5751 Published : June 27, 2024, 7:15 p.m. 18 hours, 27 minutes ago Description : BerriAI/litellm version v1.35.8 contains a vulnerability where an attacker can achieve remote code execution. The vulnerability exists in the `add_deployment` function, which decodes and decrypts environment variables from base64 and assigns them to `os.environ`. An attacker can exploit this by sending a malicious payload to the `/config/update` endpoint, which is then processed and executed by the server when the `get_secret` function is triggered. This requires the server to use Google KMS and a database to store a model. Severity:

An attacker can exploit this by sending a malicious payload to the `/config/update` endpoint, which is then processed and executed by the server when the `get_secret` function is triggered. Cvss vector : Cvss Base Score N/A Attack Range N/A Cvss Impact Score N/A Attack Complexity N/A Cvss Expoit Score N/A Authentication N/A Calculate full CVSS 2.0 Vectors scores

A vulnerability was found in berriai litellm up to 1.35.8 . It has been declared as very critical . This vulnerability affects the function add_deployment of the component Environment Variable Handler . The manipulation leads to code injection. This vulnerability was named CVE-2024-5751 . The attack can be initiated remotely. There is no exploit available.

BerriAI/litellm version v1.35.8 contains a vulnerability where an attacker can achieve remote code execution. The vulnerability exists in the `add_deployment` function, which decodes and decrypts environment variables from base64 and assigns them to `os.environ`. An attacker can exploit this by sending a malicious payload to the `/config/update` endpoint, which is then processed and executed by the server when the `get_secret` function is triggered. This requires the server to use Google KMS and a database to store a model.