Server-Side Template Injection in BerriAI/litellm

CVE-2024-2952 is a Server-Side Template Injection (SSTI) vulnerability found in BerriAI/litellm, an open-source AI Gateway that provides a unified API for over 100 large language models [1]. The flaw resides in the /completions endpoint, specifically within the hf_chat_template method. This method processes the chat_template parameter from a Hugging Face model's tokenizer_config.json file through the Jinja template engine without proper sanitization of user-controlled input [2][3].

An attacker can exploit this vulnerability by crafting a malicious tokenizer_config.json file that contains Jinja template directives. Because the template is rendered server-side using Jinja2's Environment class (which allows arbitrary code execution by default), the attacker can inject expressions that execute arbitrary Python code on the litellm server [2][4]. The attack requires the ability to influence the chat_template value, which can occur when an application allows users to specify a model or tokenizer configuration from external sources.

Successful exploitation grants the attacker arbitrary code execution on the server running litellm. This could lead to full system compromise, including data exfiltration, lateral movement within the environment, or disruption of the AI gateway service. The vulnerability is classified as critical due to the high impact of remote code execution without authentication [2].

The vulnerability was addressed in a commit referenced as 8a1cdc9, which replaced the standard Jinja2 Environment with an ImmutableSandboxedEnvironment and used a BaseLoader to restrict template features [4]. Users are strongly advised to update to the patched version immediately. No known public exploits have been reported at the time of publication, but the technical details are publicly available.