CVE-2024-2952: BerriAI LiteLLM SSTI in completions endpoint

Executive brief

LiteLLM, a tool used to connect various AI models to applications, contains a critical security flaw in its completions interface. An attacker can exploit this by providing a specially crafted configuration file that allows them to execute unauthorized commands on the server. This could lead to a complete takeover of the server, theft of sensitive data, or disruption of AI services.

Technical details

A Server-Side Template Injection (SSTI) vulnerability exists in LiteLLM's `/completions` endpoint. The flaw is located in the `hf_chat_template` method, which processes the `chat_template` parameter from `tokenizer_config.json` files using the Jinja2 template engine without adequate sanitization. A remote, unauthenticated attacker can exploit this by supplying a malicious configuration file, leading to arbitrary code execution on the host server. The issue is addressed in version 1.34.42.

Affected products

• BerriAI litellm < 1.34.42

Timeline

• 2024-04-10: advisory
• 2024-04-10: disclosed
• 2024-04-10: patched

References

• https://api.github.com/users/ishaan-jaff
• https://github.com/ishaan-jaff
• https://api.github.com/users/ishaan-jaff/gists%7B/gist_id%7D
• https://api.github.com/users/ishaan-jaff/repos
• https://avatars.githubusercontent.com/u/29436595?v=4
• https://api.github.com/users/ishaan-jaff/events%7B/privacy%7D