SSRF in berriai/litellm

Vulnerability

A Server-Side Request Forgery (SSRF) vulnerability exists in LiteLLM version 1.38.10 [2]. The application does not validate the api_base parameter in requests to POST /chat/completions, allowing an attacker to specify an arbitrary domain. This causes the server to send a request to that domain, including the OpenAI API key in the request.

Exploitation

An attacker can set the api_base parameter to their own controlled domain. When a legitimate request is made, the OpenAI API key is forwarded to the attacker's server, allowing interception of the key [2][4]. No authentication is required beyond normal API access.

Impact

With the stolen API key, an attacker gains unauthorized access to the victim's OpenAI account, enabling misuse of API resources and potentially incurring costs or accessing sensitive data [2].

Mitigation

The vulnerability was fixed in commit ba1912a on the LiteLLM repository [3]. The fix adds a check is_request_body_safe that blocks the api_base and base_url parameters in request bodies. Users should update to a patched version or apply the commit to their deployment.