Description (CNA)
LiteLLM prior to 1.83.14 allows an authenticated internal_user to create API keys with access to routes that their role does not permit. When generating a key, the allowed_routes field is stored without verifying that the specified routes fall within the user's own permissions. A key created with access to admin-only routes can then be used to reach those routes successfully, bypassing the role-based access controls that would otherwise block the request, enabling full privilege escalation from internal_user to proxy_admin.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| BerriAI / litellm | affected 0 before 1.83.14 |
CWE
CWE-863
References
- https://www.obsidiansecurity.com/blog/litellm-privilege-escalation-rce
- https://gist.github.com/13ph03nix/9ec616e1fdc77b3673509c60206e827f
- https://huntr.com/bounties/8e75edfb-ff05-4e63-bfca-2d93d03fb3b9
- https://github.com/BerriAI/litellm/releases/tag/v1.83.14-stable
- https://github.com/BerriAI/litellm/commit/d910a95661fce3cdd36f3b06c03ecf9c46c6457c
- https://github.com/BerriAI/litellm/commit/2220f3076ac89bd2a2e3439acf57dcfbec2434c9
- https://github.com/BerriAI/litellm/commit/5190bd07eb23a037745d86328096f54378f1614a
- https://www.vulncheck.com/advisories/litellm-privilege-escalation-via-api-key-generation
ADP enrichment
No English description supplied.
No references supplied.
A flaw was found in LiteLLM. An authenticated internal user can exploit this vulnerability by creating API keys that grant access to routes beyond their assigned role. This occurs because the system fails to verify if the specified allowed_routes for the API key align with the user's actual permissions. Consequently, a malicious internal user can achieve full privilege escalation, gaining administrative access (proxy_admin) and bypassing role-based access controls.