CVE-2024-2952

Description

BerriAI/litellm is vulnerable to Server-Side Template Injection (SSTI) via the `/completions` endpoint. The vulnerability arises from the `hf_chat_template` method processing the `chat_template` parameter from the `tokenizer_config.json` file through the Jinja template engine without proper sanitization. Attackers can exploit this by crafting malicious `tokenizer_config.json` files that execute arbitrary code on the server.

CVSS v3.1 Score

9.8

CRITICAL

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness Type (CWE)

CWE-76 CWE-76

Affected Products

Vendor	Product	Versions
litellm	litellm	< 1.34.42

References

Advisories & Patches

https://github.com/berriai/litellm/commit/8a1cdc901708b07b7ff4eca20f9cb0f1f0e8d0b3 https://github.com/berriai/litellm/commit/8a1cdc901708b07b7ff4eca20f9cb0f1f0e8d0b3

Exploits

https://huntr.com/bounties/a9e0a164-6de0-43a4-a640-0cbfb54220a4 https://huntr.com/bounties/a9e0a164-6de0-43a4-a640-0cbfb54220a4

Frequently Asked Questions

What is CVE-2024-2952? +

BerriAI/litellm is vulnerable to Server-Side Template Injection (SSTI) via the `/completions` endpoint. The vulnerability arises from the `hf_chat_template` method processing the `chat_template` parameter from the `tokenizer_config.json` file through the Jinja template engine without proper sanitization. Attackers can exploit this by crafting malicious `tokenizer_config.json` files that execute arbitrary code on the server. It has a CVSS v3.1 base score of 9.8 (CRITICAL).

How severe is CVE-2024-2952? +

CVE-2024-2952 has a CVSS v3.1 score of 9.8 out of 10, rated CRITICAL. This is a critical vulnerability that should be patched immediately.

What products are affected by CVE-2024-2952? +

CVE-2024-2952 affects products from litellm, specifically: litellm. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2024-2952? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2024-34359 9.6

llama-cpp-python is the Python bindings for llama.cpp. `llama-cpp-python` depends on class `Llama` in `llama.py` to load `.gguf` llama.cpp or Latency …

CVE-2024-4897 8.4

parisneo/lollms-webui, in its latest version, is vulnerable to remote code execution due to an insecure dependency on llama-cpp-python version llama_cpp_python-0.2.61+cpuavx2-cp311-cp311-manylinux_2_31_x86_64. …

CVE-2026-11311 8.1

When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX …

CVE-2024-1882 7.2

This vulnerability allows an already authenticated admin user to create a malicious payload that could be leveraged for remote code …

CVE-2024-21600 6.5

An Improper Neutralization of Equivalent Special Elements vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on …

CVE-2024-1883 6.3

This is a reflected cross site scripting vulnerability in the PaperCut NG/MF application server. An attacker can exploit this weakness …