CVE-2024-6587

CVSS V2 None CVSS V3 None
Description
A Server-Side Request Forgery (SSRF) vulnerability exists in berriai/litellm version 1.38.10. This vulnerability allows users to specify the `api_base` parameter when making requests to `POST /chat/completions`, causing the application to send the request to the domain specified by `api_base`. This request includes the OpenAI API key. A malicious user can set the `api_base` to their own domain and intercept the OpenAI API key, leading to unauthorized access and potential misuse of the API key.
Overview
  • CVE ID
  • CVE-2024-6587
  • Assigner
  • @huntr_ai
  • Vulnerability Status
  • PUBLISHED
  • Published Version
  • 2024-09-13T15:59:53.557Z
  • Last Modified Date
  • 2024-09-13T16:53:11.849Z
Weakness Enumerations
CWE URL
CWE-918 http://cwe.mitre.org/data/definitions/918.html
References
Reference URL Reference Tags
https://huntr.com/bounties/4001e1a2-7b7a-4776-a3ae-e6692ec3d997
https://github.com/berriai/litellm/commit/ba1912afd1b19e38d3704bb156adf887f91ae1e0
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2024-6587
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-6587
History
Created Old Value New Value Data Type Notes
2024-09-14 13:10:18 Added to TrackCVE