CVE-2025-11203

Executive Summary

CVE-2025-11203 is a low-severity (CVSS 3.5) information disclosure vulnerability in LiteLLM, an open-source proxy for managing multiple LLM providers. The flaw resides in the /health endpoint, which improperly exposes the API_KEY parameter to authenticated remote attackers. This allows an attacker with valid credentials to retrieve stored API keys and other credentials, potentially leading to lateral movement or data exfiltration. The vulnerability has no known public exploit code or proof-of-concept, but the risk is elevated due to the sensitive nature of exposed credentials.

Supply Chain & Package Security

LiteLLM is distributed as a Python package via PyPI (litellm). Organizations using this package should verify their version and monitor for updates. The vulnerability affects the health endpoint logic, which is part of the core proxy server. No malicious package versions have been reported, but the lack of a patch increases supply chain risk.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Authentication is required, but low-level access suffices.
• User Interaction (UI): None (N) – No user action needed.
• Scope (S): Unchanged (U) – Impact confined to the vulnerable component.
• Confidentiality (C): Low (L) – Limited disclosure of API keys.
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No denial of service.

Threat Level: Low. Exploitation requires authentication, but the disclosed credentials can enable further attacks.

Deep Dive & Mechanics

The vulnerability exists in the /health endpoint of LiteLLM’s proxy server. When a request is made to this endpoint, the server processes the API_KEY parameter from the query string or request body. Due to improper access controls, the response includes the plaintext API key in the output, even though the endpoint is intended only for health status checks.

Root Cause: The health endpoint does not sanitize or redact sensitive parameters before returning them in the response. This violates the principle of least privilege and exposes credentials to any authenticated user.

Attack Flow:

1. Attacker obtains valid authentication credentials (e.g., via phishing or weak passwords).
2. Attacker sends a GET request to /health?API_KEY=test.
3. The server returns a JSON response containing the actual API key in the api_key field.
4. Attacker uses the leaked key to access other services or escalate privileges.

Vulnerable vs. Patched Code

Vulnerable Code (hypothetical):

@app.route('/health')
def health():
    api_key = request.args.get('API_KEY')
    # ... health check logic ...
    return jsonify({"status": "ok", "api_key": api_key})

Patched Code (recommended):

@app.route('/health')
def health():
    # Do not accept or return API_KEY
    return jsonify({"status": "ok"})

The patch removes the API_KEY parameter from the health endpoint entirely, preventing any disclosure.

Exploitation & Lab Setup

Red Team

Prerequisites: Valid authentication credentials for LiteLLM.

Exploitation Steps:

1. Authenticate to the LiteLLM proxy (e.g., via API token).
2. Send a crafted request to the health endpoint:

   curl -X GET "https://target-litellm:4000/health?API_KEY=test" \
        -H "Authorization: Bearer <valid_token>"
   

3. Observe the response containing the actual API key:

   {"status": "ok", "api_key": "sk-...actual-key..."}
   

Lab Setup:

• Deploy a vulnerable LiteLLM instance using Docker:

  docker run -d -p 4000:4000 --name litellm-vuln ghcr.io/berriai/litellm:latest
  

• Configure a test API key in the environment variable LITELLM_MASTER_KEY.
• Access the health endpoint with a valid token.

Blue Team

Detection:

• Monitor for unusual requests to /health with API_KEY parameter.
• Alert on responses containing "api_key" field in health endpoint.

Hunting:

• Search logs for GET /health?API_KEY= patterns.
• Correlate with authentication events to identify potential credential theft.

Indicators of Compromise (IOCs)

• Network: HTTP requests to /health with API_KEY parameter.
• Logs: Server logs showing api_key field in health endpoint responses.
• Credentials: Unauthorized use of API keys that were previously exposed via health endpoint.

Detection Engineering

YARA Rule

rule CVE_2025_11203_LiteLLM_Health_Disclosure {
    meta:
        description = "Detects LiteLLM health endpoint responses containing API_KEY"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-11203"
    strings:
        $health = "/health" ascii nocase
        $api_key = "api_key" ascii nocase
        $response = "status" ascii nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2025-11203 LiteLLM API Key Disclosure via Health Endpoint
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects requests to LiteLLM health endpoint with API_KEY parameter
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: litellm
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '/health?API_KEY='
    condition: selection
falsepositives:
    - Legitimate health checks with API_KEY parameter (rare)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-11203 LiteLLM API Key Disclosure"; flow:to_server; http.method; content:"GET"; http.uri; content:"/health"; content:"API_KEY"; nocase; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the /health endpoint or restrict access to trusted IPs only.
2. Implement input sanitization to remove API_KEY from health responses.
3. Rotate all API keys that may have been exposed.

Long-term Fix:

• Apply vendor patch when available (monitor GitHub for updates).
• Upgrade to a patched version of LiteLLM.

Workaround:

• Use a reverse proxy (e.g., Nginx) to block requests containing API_KEY in the health endpoint:

  location /health {
      if ($arg_API_KEY) {
          return 403;
      }
      proxy_pass http://litellm_backend;
  }
  

Valters IT
Securing Digital Frontiers