CVE-2024-4888: berriai berriai/litellm Missing Authorization

Vulnerability summary

CVE-2024-4888 is a high (CVSS 8.1) Missing Authorization vulnerability in berriai berriai/litellm. EPSS estimates a 0.62% chance of exploitation in the next 30 days, higher than 48.7% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 06-06-2024
   PublishedVulnerability first disclosed.
2. 03-11-2024
   Last modifiedVulnerability information updated.

Description

BerriAI's litellm, in its latest version, is vulnerable to arbitrary file deletion due to improper input validation on the `/audio/transcriptions` endpoint. An attacker can exploit this vulnerability by sending a specially crafted request that includes a file path to the server, which then deletes the specified file without proper authorization or validation. This vulnerability is present in the code where `os.remove(file.filename)` is used to delete a file, allowing any user to delete critical files on the server such as SSH keys, SQLite databases, or configuration files.

• CWE-862Missing AuthorizationThe product does not perform an authorization check when an actor attempts to access a resource or perform an action.