Vulnerability-Lookup

CVE-2024-6825 (GCVE-0-2024-6825)

Vulnerability from cvelistv5 – Published: 2025-03-20 10:11 – Updated: 2025-10-15 12:49

Title

Remote Code Execution in BerriAI/litellm

Summary

BerriAI/litellm version 1.40.12 contains a vulnerability that allows remote code execution. The issue exists in the handling of the 'post_call_rules' configuration, where a callback function can be added. The provided value is split at the final '.' mark, with the last part considered the function name and the remaining part appended with the '.py' extension and imported. This allows an attacker to set a system method, such as 'os.system', as a callback, enabling the execution of arbitrary commands when a chat response is processed.

Severity ?

8.8 (High)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-94 - Improper Control of Generation of Code

Assigner

@huntr_ai

References

URL

Tags

	https://huntr.com/bounties/1d98bebb-6cf4-46c9-87c…
	https://github.com/berriai/litellm/commit/441c727…

Impacted products

	Vendor	Product	Version
	berriai	berriai/litellm	Affected: unspecified , < v1.65.4.dev6 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-6825",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-20T13:42:48.482640Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-20T13:43:00.744Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "berriai/litellm",
          "vendor": "berriai",
          "versions": [
            {
              "lessThan": "v1.65.4.dev6",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "BerriAI/litellm version 1.40.12 contains a vulnerability that allows remote code execution. The issue exists in the handling of the \u0027post_call_rules\u0027 configuration, where a callback function can be added. The provided value is split at the final \u0027.\u0027 mark, with the last part considered the function name and the remaining part appended with the \u0027.py\u0027 extension and imported. This allows an attacker to set a system method, such as \u0027os.system\u0027, as a callback, enabling the execution of arbitrary commands when a chat response is processed."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94 Improper Control of Generation of Code",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-15T12:49:46.893Z",
        "orgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
        "shortName": "@huntr_ai"
      },
      "references": [
        {
          "url": "https://huntr.com/bounties/1d98bebb-6cf4-46c9-87c3-d3b1972973b5"
        },
        {
          "url": "https://github.com/berriai/litellm/commit/441c7275ed2715f47650a7c2e525055c804073a9"
        }
      ],
      "source": {
        "advisory": "1d98bebb-6cf4-46c9-87c3-d3b1972973b5",
        "discovery": "EXTERNAL"
      },
      "title": "Remote Code Execution in BerriAI/litellm"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
    "assignerShortName": "@huntr_ai",
    "cveId": "CVE-2024-6825",
    "datePublished": "2025-03-20T10:11:36.172Z",
    "dateReserved": "2024-07-16T23:27:36.399Z",
    "dateUpdated": "2025-10-15T12:49:46.893Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-6825\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-03-20T13:42:48.482640Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-03-20T13:42:55.312Z\"}}], \"cna\": {\"title\": \"Remote Code Execution in BerriAI/litellm\", \"source\": {\"advisory\": \"1d98bebb-6cf4-46c9-87c3-d3b1972973b5\", \"discovery\": \"EXTERNAL\"}, \"metrics\": [{\"cvssV3_0\": {\"scope\": \"UNCHANGED\", \"version\": \"3.0\", \"baseScore\": 8.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"berriai\", \"product\": \"berriai/litellm\", \"versions\": [{\"status\": \"affected\", \"version\": \"unspecified\", \"lessThan\": \"v1.65.4.dev6\", \"versionType\": \"custom\"}]}], \"references\": [{\"url\": \"https://huntr.com/bounties/1d98bebb-6cf4-46c9-87c3-d3b1972973b5\"}, {\"url\": \"https://github.com/berriai/litellm/commit/441c7275ed2715f47650a7c2e525055c804073a9\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"BerriAI/litellm version 1.40.12 contains a vulnerability that allows remote code execution. The issue exists in the handling of the \u0027post_call_rules\u0027 configuration, where a callback function can be added. The provided value is split at the final \u0027.\u0027 mark, with the last part considered the function name and the remaining part appended with the \u0027.py\u0027 extension and imported. This allows an attacker to set a system method, such as \u0027os.system\u0027, as a callback, enabling the execution of arbitrary commands when a chat response is processed.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-94\", \"description\": \"CWE-94 Improper Control of Generation of Code\"}]}], \"providerMetadata\": {\"orgId\": \"c09c270a-b464-47c1-9133-acb35b22c19a\", \"shortName\": \"@huntr_ai\", \"dateUpdated\": \"2025-10-15T12:49:46.893Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-6825\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-10-15T12:49:46.893Z\", \"dateReserved\": \"2024-07-16T23:27:36.399Z\", \"assignerOrgId\": \"c09c270a-b464-47c1-9133-acb35b22c19a\", \"datePublished\": \"2025-03-20T10:11:36.172Z\", \"assignerShortName\": \"@huntr_ai\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

GHSA-53GH-P8JC-7RG8

Vulnerability from github – Published: 2025-03-20 12:32 – Updated: 2025-10-15 16:06

Summary

LiteLLM Vulnerable to Remote Code Execution (RCE)

Details

Severity ?

8.8 (High)


                  
                    CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "litellm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.40.3.dev2"
            },
            {
              "last_affected": "1.40.12"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-6825"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-77",
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-03-20T19:55:11Z",
    "nvd_published_at": "2025-03-20T10:15:33Z",
    "severity": "HIGH"
  },
  "details": "BerriAI/litellm version 1.40.12 contains a vulnerability that allows remote code execution. The issue exists in the handling of the \u0027post_call_rules\u0027 configuration, where a callback function can be added. The provided value is split at the final \u0027.\u0027 mark, with the last part considered the function name and the remaining part appended with the \u0027.py\u0027 extension and imported. This allows an attacker to set a system method, such as \u0027os.system\u0027, as a callback, enabling the execution of arbitrary commands when a chat response is processed.",
  "id": "GHSA-53gh-p8jc-7rg8",
  "modified": "2025-10-15T16:06:56Z",
  "published": "2025-03-20T12:32:45Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6825"
    },
    {
      "type": "WEB",
      "url": "https://github.com/berriai/litellm/commit/441c7275ed2715f47650a7c2e525055c804073a9"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/BerriAI/litellm"
    },
    {
      "type": "WEB",
      "url": "https://github.com/BerriAI/litellm/blob/056913fd7049923a106130b02d7c29e7f312beec/litellm/utils.py#L2818"
    },
    {
      "type": "WEB",
      "url": "https://huntr.com/bounties/1d98bebb-6cf4-46c9-87c3-d3b1972973b5"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "LiteLLM Vulnerable to Remote Code Execution (RCE)"
}

FKIE_CVE-2024-6825

Vulnerability from fkie_nvd - Published: 2025-03-20 10:15 - Updated: 2025-10-15 13:15

Severity ?

8.8 (High) - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

References

	URL	Tags
	security@huntr.dev	https://github.com/berriai/litellm/commit/441c7275ed2715f47650a7c2e525055c804073a9
	security@huntr.dev	https://huntr.com/bounties/1d98bebb-6cf4-46c9-87c3-d3b1972973b5	Exploit, Third Party Advisory

Impacted products

	Vendor	Product	Version
	litellm	litellm	*
	litellm	litellm	1.65.4

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:litellm:litellm:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "CA751173-C195-4141-990E-BF283359EB51",
              "versionEndExcluding": "1.65.4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:litellm:litellm:1.65.4:dev2:*:*:*:*:*:*",
              "matchCriteriaId": "9FF1A650-6A97-453B-AC95-C05B9864B71C",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "BerriAI/litellm version 1.40.12 contains a vulnerability that allows remote code execution. The issue exists in the handling of the \u0027post_call_rules\u0027 configuration, where a callback function can be added. The provided value is split at the final \u0027.\u0027 mark, with the last part considered the function name and the remaining part appended with the \u0027.py\u0027 extension and imported. This allows an attacker to set a system method, such as \u0027os.system\u0027, as a callback, enabling the execution of arbitrary commands when a chat response is processed."
    },
    {
      "lang": "es",
      "value": "BerriAI/litellm versi\u00f3n 1.40.12 contiene una vulnerabilidad que permite la ejecuci\u00f3n remota de c\u00f3digo. El problema se presenta en la gesti\u00f3n de la configuraci\u00f3n \u0027post_call_rules\u0027, donde se puede a\u00f1adir una funci\u00f3n de devoluci\u00f3n de llamada. El valor proporcionado se divide en el \u00faltimo punto \".\"; la \u00faltima parte se considera el nombre de la funci\u00f3n y la parte restante se a\u00f1ade con la extensi\u00f3n \".py\" y se importa. Esto permite a un atacante configurar un m\u00e9todo del sistema, como \"os.system\", como devoluci\u00f3n de llamada, lo que permite la ejecuci\u00f3n de comandos arbitrarios al procesar una respuesta de chat."
    }
  ],
  "id": "CVE-2024-6825",
  "lastModified": "2025-10-15T13:15:49.953",
  "metrics": {
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.0"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "security@huntr.dev",
        "type": "Secondary"
      }
    ]
  },
  "published": "2025-03-20T10:15:33.237",
  "references": [
    {
      "source": "security@huntr.dev",
      "url": "https://github.com/berriai/litellm/commit/441c7275ed2715f47650a7c2e525055c804073a9"
    },
    {
      "source": "security@huntr.dev",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://huntr.com/bounties/1d98bebb-6cf4-46c9-87c3-d3b1972973b5"
    }
  ],
  "sourceIdentifier": "security@huntr.dev",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ],
      "source": "security@huntr.dev",
      "type": "Secondary"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2024-6825 (GCVE-0-2024-6825)

GHSA-53GH-P8JC-7RG8

FKIE_CVE-2024-6825

Tags

Sightings

Nomenclature