CVE-2024-4264: falha crítica em berriai/litellm
Remote Code Execution in berriai/litellm
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.8epss 0.9%
A remote code execution (RCE) vulnerability exists in the berriai/litellm project due to improper control of the generation of code when using the `eval` function unsafely in the `litellm.get_secret()` method. Specifically, when the server utilizes Google KMS, untrusted data is passed to the `eval` function without any sanitization. Attackers can exploit this vulnerability by injecting malicious values into environment variables through the `/config/update` endpoint, which allows for the update of settings in `proxy_server_config.yaml`.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
berriai · berriai/litellmCVEs relacionadas — berriai/litellm
No mesmo produto, das mais perigosas para as menos.
CVE-2024-6587HIGHSSRF in berriai/litellmEPSS 34.4%CVE-2024-6825HIGHRemote Code Execution in BerriAI/litellmEPSS 1.7%CVE-2024-2952CRITICALServer-Side Template Injection in BerriAI/litellmEPSS 1.3%CVE-2024-5751CRITICALRemote Code Execution in BerriAI/litellmEPSS 0.9%CVE-2024-4889HIGHCode Injection in berriai/litellmEPSS 0.9%CVE-2024-8984HIGHDenial of Service (DoS) in berriai/litellmEPSS 0.9%