CVE-2024-6587

CVE-2024-6587 is a server-side request forgery (SSRF, CWE-918) flaw in the BerriAI LiteLLM LLM proxy, reported for version 1.38.10. It is triggered when a client supplies an attacker-controlled `api_base` parameter in a request to POST /chat/completions, causing LiteLLM to send that request — including the configured OpenAI API key — to the attacker-chosen domain. An attacker who points `api_base` at a server they control can intercept the OpenAI API key and then access or misuse it directly against the OpenAI API, giving a high-confidentiality impact per the 7.5 CVSS score (no integrity or availability impact). Any deployment of LiteLLM that allows callers, without authentication per the CVSS vector (PR:N), to set `api_base` on this endpoint is affected, with internet-exposed proxy instances at greatest risk. No confirmed in-the-wild exploitation of this specific CVE is documented yet, but a public proof-of-concept exists, EPSS assigns a ~35% (98th-percentile) probability of exploitation within 30 days, and defenders are reporting a broader coordinated surge in SSRF exploitation.

What to do: Upgrade LiteLLM to the latest patched release and stop trusting client-supplied `api_base` values — validate or allow-list them, or disable user-controlled `api_base` on /chat/completions. Review proxy logs for completions requests sent to unexpected external domains and rotate any OpenAI API keys configured in LiteLLM, since a leaked key gives attackers direct access to your OpenAI account and billing.