PT-2024-35137 · Unknown · Berriai/Litellm

Published 2024-06-06 · Updated 2024-09-23 · CVE-2024-5225

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions berriai/litellm repository (affected versions not specified)

Description An SQL Injection issue exists due to improper neutralization of special elements used in an SQL command. The affected code constructs an SQL query by concatenating an unvalidated api key parameter directly into the query, making it susceptible to SQL Injection if the api key contains malicious data. This issue affects the /global/spend/logs endpoint. Successful exploitation could lead to unauthorized access, data manipulation, exposure of confidential information, and denial of service (DoS).

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-5225

GHSA-H6M6-JJ8V-94JJ

Affected Products

Berriai/Litellm

References · 10

• 🔥 https://huntr.com/bounties/491e4884-0306-4cd4-8fe2-9a19de33bf5c · Exploit
• https://osv.dev/vulnerability/CVE-2024-5225 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-5225 · Security Note
• https://osv.dev/vulnerability/GHSA-h6m6-jj8v-94jj · Vendor Advisory
• https://github.com/BerriAI/litellm · Note
• https://github.com/BerriAI/litellm/pull/3940 · Note
• https://github.com/BerriAI/litellm/commit/f75c15d6cd535aa78014378ad532de1df6be2f56 · Note
• https://twitter.com/VulmonFeeds/status/1798822805951091025 · Twitter Post
• https://t.me/cvenotify/95735 · Telegram Post
• https://twitter.com/CVEnew/status/1798786702200147990 · Twitter Post