Improper Authorization in BerriAI LiteLLM Admin Key Handler

Executive Summary

This vulnerability exists in LiteLLM's key management endpoints, specifically in the functions that handle blocking and unblocking API keys. It allows any user with the internal_user role to block or unblock any API key, including administrative keys, due to insufficient ownership or role-based access controls.

This improper authorization flaw means that low-privileged users can manipulate critical API keys they should not have control over.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can be exploited remotely by low-privileged users to perform Denial of Service (DoS) attacks by disabling critical API keys.

Additionally, attackers can bypass security controls by unblocking malicious keys, potentially leading to unauthorized access or disruption of services.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves improper authorization in LiteLLM's key management endpoints (/key/block and /key/unblock), allowing users with the internal_user role to block or unblock API keys improperly.

To detect exploitation attempts on your system or network, you should monitor access logs for unusual or unauthorized requests to the /key/block and /key/unblock endpoints, especially those initiated by users with the internal_user role.

Commands to help detect this may include:

• Using grep or similar tools to search server logs for access to /key/block or /key/unblock endpoints, e.g., `grep "/key/block" /var/log/litellm/access.log`
• Checking for unusual API key status changes or audit logs indicating key blocking/unblocking actions.
• Reviewing user roles and permissions to identify if any internal_user role accounts are performing unexpected actions.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting access to the key management endpoints (/key/block and /key/unblock) to only trusted and properly authorized users.

Review and tighten role-based access controls to ensure that users with the internal_user role cannot block or unblock API keys unless explicitly authorized.

Monitor and audit all key management activities to detect and respond to any unauthorized actions promptly.

If possible, update LiteLLM to a version later than 1.63.1 where this vulnerability is addressed.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability in BerriAI litellm's key management endpoints allows low-privileged users to block or unblock API keys, including administrative keys, due to improper authorization. This can lead to denial of service attacks or bypassing security controls.

Such improper authorization and potential security control bypasses can undermine the integrity and availability of systems, which are critical aspects of compliance with standards like GDPR and HIPAA that require strict access controls and protection of sensitive data.

Therefore, this vulnerability could negatively impact compliance with these regulations by exposing systems to unauthorized actions and potential data protection failures.

Useful 0 Not Useful 0