CVE-2025-0628

Executive Summary

CVE-2025-0628 is an improper authorization vulnerability in BerriAI/litellm (main-latest version). The flaw allows a user with the internal_user_viewer role to receive an overly privileged API key upon login. This key grants full administrative access, including endpoints like /users/list and /users/get_users, enabling any such user to escalate privileges to PROXY ADMIN. The vulnerability has a CVSS score of 8.1 (High) and is currently unpatched. No public exploit code or Nuclei templates are available, but the attack vector is straightforward due to the misconfiguration.

Supply Chain & Package Security

This vulnerability affects the BerriAI/litellm Python package. Organizations using this package in their supply chain should immediately audit their deployments for the presence of internal_user_viewer roles and restrict API key issuance. Since no patch exists, consider forking the repository and implementing custom authorization checks or switching to an alternative proxy solution until a fix is released.

CVSS Breakdown & Threat Level

• CVSS Score: 8.1 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – requires a valid internal_user_viewer account
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

Threat Level: Critical due to the ease of exploitation and the potential for full administrative takeover. The EPSS score of 0.0% indicates low exploitation likelihood currently, but this may change as awareness grows.

Deep Dive & Mechanics

The vulnerability stems from improper authorization in the API key generation logic. When a user with the internal_user_viewer role authenticates, the application issues an API key that does not correctly scope permissions. Instead of limiting access to read-only viewer endpoints, the key is assigned the same privileges as a PROXY ADMIN. This allows the user to call administrative endpoints such as:

• /users/list – List all users
• /users/get_users – Retrieve user details
• Other admin-only endpoints

The root cause is a missing or incorrect role check in the key generation middleware. The application likely uses a role-based access control (RBAC) system that fails to enforce the internal_user_viewer role’s restrictions when creating the API key.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

# In key generation logic
def generate_api_key(user):
    # Missing role check
    key = create_key_with_full_access()
    return key

Patched Code (Conceptual):

def generate_api_key(user):
    if user.role == 'internal_user_viewer':
        key = create_key_with_read_only_access()
    else:
        key = create_key_with_full_access()
    return key

No official patch is available from the vendor. The above is a recommended fix.

Exploitation & Lab Setup

Red Team

1. Prerequisites: Obtain a valid internal_user_viewer account on a vulnerable LiteLLM instance.
2. Login: Authenticate to the application and capture the API key returned in the response.
3. Escalate: Use the API key to call admin endpoints:

   curl -H "Authorization: Bearer <captured_key>" https://target.litellm.example/users/list
   

4. Verify: Confirm access to sensitive data and admin functionality.

Blue Team

1. Detection: Monitor for API keys issued to internal_user_viewer roles that are used to access admin endpoints.
2. Mitigation: Implement strict RBAC in the application code (see patched code above). Restrict API key permissions at the middleware level.
3. Workaround: Disable the internal_user_viewer role or manually revoke all API keys for that role until a patch is applied.

Indicators of Compromise (IOCs)

• Network: Unusual API calls to /users/list, /users/get_users, or other admin endpoints from accounts with internal_user_viewer role.
• Logs: Authentication logs showing internal_user_viewer users generating API keys with unexpected permissions.
• System: Presence of API keys with full admin access that were issued to low-privilege users.

Detection Engineering

YARA Rule

rule CVE_2025_0628_LiteLLM_PrivEsc {
    meta:
        description = "Detects overly privileged API key generation for internal_user_viewer role in LiteLLM"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-0628"
    strings:
        $s1 = "internal_user_viewer" nocase
        $s2 = "PROXY_ADMIN" nocase
        $s3 = "create_key_with_full_access" nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2025-0628 LiteLLM Privilege Escalation
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects API calls from internal_user_viewer to admin endpoints
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: litellm
detection:
    selection:
        user_role: "internal_user_viewer"
        endpoint:
            - "/users/list"
            - "/users/get_users"
    condition: selection
falsepositives:
    - Legitimate admin actions (if role misconfigured)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-0628 LiteLLM Privilege Escalation"; flow:to_server; content:"/users/list"; http_uri; nocase; content:"Authorization"; http_header; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable the internal_user_viewer role or manually restrict API key permissions in the application configuration.
2. Short-term: Apply the conceptual patch shown above to enforce role-based API key scoping.
3. Long-term: Monitor the BerriAI/litellm repository for an official patch. Consider forking the project to maintain custom security fixes.
4. Compensating Controls: Implement network segmentation to limit access to the LiteLLM admin interface. Use a Web Application Firewall (WAF) to block unauthorized API calls.

Valters IT
DevSecOps & Cyber Threat Intelligence