PT-2024-37087 · Unknown · Berriai/Litellm

Published 2024-06-27 · Updated 2024-09-20 · CVE-2024-5710

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions: berriai/litellm version 1.34.34

Description: The issue is related to improper access control in the team management functionality, allowing attackers to perform unauthorized actions such as creating, updating, viewing, deleting, blocking, and unblocking any teams, as well as adding or deleting any member to or from any teams. This is due to insufficient access control checks in various team management endpoints.

Recommendations: For version 1.34.34, consider temporarily restricting access to the team management functionality until a patch is available. As a mitigation measure, restrict the use of the vulnerable team management endpoints to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Access Control

Missing Authorization

Weakness Enumeration

CWE-284

CWE-862

Related Identifiers

CVE-2024-5710

GHSA-QQCV-VG9F-5RR3

Affected Products

Berriai/Litellm

References · 9

• 🔥 https://huntr.com/bounties/70897f59-a966-4d93-b71e-745e3da91970 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-5710 · Security Note
• https://osv.dev/vulnerability/CVE-2024-5710 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qqcv-vg9f-5rr3 · Vendor Advisory
• https://github.com/berriai/litellm · Note
• https://github.com/BerriAI/litellm/blob/224148d6133ee50801cb129cbd21ccc213992e25/litellm/proxy/auth/user_api_key_auth.py#L1020 · Note
• https://github.com/BerriAI/litellm/commit/da3ae00bd68f451ed8ddf0bc0a9fd34bde5554d6 · Note
• https://t.me/cvenotify/84883 · Telegram Post
• https://t.me/cvenotify/95485 · Telegram Post