PT-2024-30090 · Google · Google Kms

Published

2024-05-18

·

Updated

2024-07-10

·

CVE-2024-4264

CVSS v3.1

9.8

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions berriai/litellm (affected versions not specified)
Description A remote code execution issue exists due to improper control of code generation when using the eval function unsafely in the litellm.get secret() method. Specifically, when the server utilizes Google KMS, untrusted data is passed to the eval function without sanitization. Attackers can exploit this by injecting malicious values into environment variables through the "/config/update" endpoint, which updates settings in proxy server config.yaml.
Recommendations As a temporary workaround, consider disabling the litellm.get secret() method until a patch is available. Restrict access to the "/config/update" endpoint to minimize the risk of exploitation. Avoid using the eval function with untrusted data until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2024-4264
GHSA-7GGM-4RJG-594W

Affected Products

Google Kms