Remote Code Execution in BerriAI/litellm

BerriAI/litellm version 1.40.12 contains a remote code execution vulnerability in the handling of the post_call_rules configuration [1][2]. The issue is that when a callback function is specified, the implementation splits the provided value at the final '.' character, treating the last part as the function name and importing the remainder as a module [2]. No validation is performed on the module name, allowing an attacker to specify dangerous Python modules such as os [2].

An attacker who can modify the post_call_rules configuration can set a system method like os.system as the callback [2]. When a chat response is processed, the callback is invoked, executing arbitrary commands with the privileges of the LiteLLM process [2]. The attack does not require authentication if the attacker has access to the configuration, which is a separate prerequisite [2].

Successful exploitation grants the attacker arbitrary command execution on the server hosting the LiteLLM proxy [2]. This can lead to full server compromise, data exfiltration, or further lateral movement within the network [2].

The vulnerability was addressed in a subsequent commit that added a security_checks function to block importing from a hardcoded list of dangerous modules, including os, sys, subprocess, shutil, and others [3]. Users should update to a patched version of litellm [3].