Recent security assessments of LiteLLM, a popular open-source large language model (LLM) gateway, have uncovered multiple high-impact vulnerabilities that expose users to significant risks, including remote code execution and credential theft. Conducted by Check Point Research, the evaluation of LiteLLM version 1.77.7 revealed critical flaws, particularly a missing authorization check on the /config/update endpoint, which allowed any authenticated user to modify the proxy’s runtime configuration. These vulnerabilities have since been addressed in version 1.83.9.
Understanding LLM Gateways
LLM gateways serve as intermediaries between applications and LLM providers, managing requests, credentials, and configurations. They centralize functionalities such as provider abstraction, request routing, and logging, making them essential in AI deployments. As their adoption grows, understanding the security implications of these systems becomes crucial.
Key Vulnerabilities in LiteLLM
The assessment identified several critical vulnerabilities, primarily stemming from inadequate access controls and improper input validation. The most significant issues include:
- Access Control Bypass: The /config/update endpoint lacked proper role-based access control (RBAC), allowing low-privileged users to modify sensitive configurations.
- Arbitrary File Read: Attackers could exploit the configuration update functionality to read any file accessible to the LiteLLM process, including sensitive credentials.
- Administrative Account Takeover: By injecting environment variables, attackers could hijack administrative credentials, gaining full control over the LiteLLM instance.
- Remote Code Execution: The gateway’s support for pass-through endpoints enabled attackers to load and execute malicious Python modules from external storage.
- Server-Side Request Forgery (SSRF): A feature allowing redirection of API calls could be exploited to extract sensitive API keys.
Access Control Bypass and Its Implications
The vulnerability in the /config/update endpoint was particularly concerning. It allowed any authenticated user to invoke this endpoint without proper authorization checks. This oversight enabled attackers to:
- Modify critical proxy settings, potentially leading to unauthorized access to sensitive data.
- Execute arbitrary code by injecting malicious Python modules through the configuration update process.
- Read sensitive files by manipulating environment variables, exposing critical system information.
Remote Code Execution via Pass-Through Endpoints
LiteLLM’s architecture supports pass-through endpoints that can proxy requests to external services. However, this feature also introduced a severe risk. Attackers could define endpoints that load Python modules from remote storage, leading to full remote code execution. This capability allows attackers to execute arbitrary commands on the LiteLLM gateway, potentially compromising the entire system.
Server-Side Request Forgery (SSRF) Vulnerability
Another critical vulnerability identified was the SSRF risk associated with the “Clientside LLM Credentials” feature. This flaw allowed authenticated users to redirect API calls to arbitrary endpoints, enabling attackers to exfiltrate sensitive API keys and probe internal networks. The lack of validation on user-configured settings exacerbated this risk, allowing attackers to bypass security measures designed to protect sensitive information.
Conclusion and Recommendations
The vulnerabilities discovered in LiteLLM underscore the importance of robust security practices in the rapidly evolving AI landscape. While LiteLLM offers significant benefits as an LLM gateway, the identified flaws highlight a concerning trend where foundational security principles are sometimes overlooked in the rush to innovate. Organizations deploying LLM gateways must prioritize security by implementing strict access controls, validating inputs rigorously, and regularly updating their systems to mitigate known vulnerabilities.
For further details on the vulnerabilities and their implications, refer to the full report by Check Point Research here.
