Arbitrary File Deletion in BerriAI/litellm

Root

Cause

CVE-2024-4888 affects BerriAI's LiteLLM AI Gateway. The vulnerability resides in the /audio/transcriptions endpoint, where improper input validation allows an attacker to supply an arbitrary file path that is passed directly to the os.remove(file.filename) call. This means any user of the API can specify a path to a file on the server's filesystem, and the server will delete it without verifying authorization or the file's purpose [1][3].

Exploitation

An attacker can exploit this flaw by sending a crafted HTTP request to the /audio/transcriptions endpoint, including a file path (e.g., ../../etc/ssh/ssh_host_rsa_key) that points to a sensitive resource. The endpoint does not require any special authentication beyond normal API access, making it accessible to any valid user of the LiteLLM proxy server. The fix, implemented in pull request #3193, introduces validation to restrict which paths can be used in this operation [2].

Impact

Successful exploitation allows unauthenticated (or low-privilege) users to delete critical files such as SSH keys, SQLite databases, configuration files, or any other file the server process has permission to remove. This can lead to denial of service (e.g., database loss), privilege escalation (e.g., removing SSH keys to lock out administrators), or complete compromise of the server's integrity [3][4].

Mitigation

A security fix has been merged via pull request #3193 in the official LiteLLM repository. Users are strongly advised to update to the latest patched version immediately. No workaround is available beyond restricting network access to the endpoint until the update is applied [2][4].