PT-2024-33259 · Unknown · Berriai/Litellm

Published 2024-06-06 · Updated 2024-10-10 · CVE-2024-4890

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions berriai/litellm version 1.27.14

Description A blind SQL injection issue exists in the application, specifically within the "/team/update" process. This issue arises due to the improper handling of the user id parameter in the raw SQL query used for deleting users. An attacker can exploit this by injecting malicious SQL commands through the user id parameter, potentially leading to unauthorized access to sensitive information such as API keys, user information, and tokens stored in the database.

Recommendations For version 1.27.14, consider disabling the /team/update process until a patch is available to prevent exploitation. Restrict access to the user id parameter in the affected process to minimize the risk of unauthorized access. Avoid using the user id parameter in the "/team/update" endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-4890

GHSA-8J42-PCFM-3467

Affected Products

Berriai/Litellm

References · 9

• 🔥 https://huntr.com/bounties/a4f6d357-5b44-4e00-9cac-f1cc351211d2 · Exploit
• https://osv.dev/vulnerability/GHSA-8j42-pcfm-3467 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-4890 · Security Note
• https://osv.dev/vulnerability/CVE-2024-4890 · Vendor Advisory
• https://github.com/BerriAI/litellm · Note
• https://github.com/BerriAI/litellm/pull/2954 · Note
• https://twitter.com/VulmonFeeds/status/1798821034218369253 · Twitter Post
• https://t.me/cvenotify/97820 · Telegram Post
• https://twitter.com/CVEnew/status/1798786690796146956 · Twitter Post