Server-Side Template Injection in LiteLLM

Executive Summary

This vulnerability is a Server-Side Template Injection (SSTI) in BerriAI litellm versions 1.82.4 and earlier. It allows unauthenticated remote attackers to execute arbitrary operating system commands by sending a specially crafted dotprompt_content parameter to the /prompts/test endpoint. The issue arises because the application uses an unsandboxed jinja2.Environment, which enables template injection attacks.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect network traffic for requests to the /prompts/test endpoint with unusual dotprompt_content parameters. Check logs for Jinja2 template injection attempts or OS command execution patterns. Review prompt ID parsing logic in litellm/proxy/prompts/prompt_endpoints.py for improper handling of versioned prompts.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow attackers to execute arbitrary OS commands on the server hosting the vulnerable litellm instance. This could lead to complete system compromise, data theft, unauthorized access, or disruption of services. Since it is unauthenticated, any attacker with network access to the endpoint can exploit it.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to severe compliance violations under GDPR and HIPAA. It may result in unauthorized access to personal or sensitive data, triggering breach notification requirements, potential fines, and reputational damage. Organizations using affected versions must address this promptly to maintain compliance.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade to a patched version of LiteLLM beyond 1.82.4. Disable the /prompts/test endpoint if unused. Implement strict input validation for prompt IDs and sanitize Jinja2 template parameters. Restrict access to PROXY_ADMIN roles and audit prompt registry permissions.

Useful 0 Not Useful 0