CVE-2024-4889: Litellm RCE Vulnerability

CVE-2024-4889 Overview

CVE-2024-4889 is a code injection vulnerability in the berriai/litellm application, version 1.34.6. The flaw resides in the secret management system, where the eval function processes unvalidated input. Exploitation requires a valid Google Key Management Service (KMS) configuration and authenticated access to the application.

An attacker can set the UI_LOGO_PATH variable to a remote server, causing the get_image function to write an attacker-controlled Google KMS configuration file to cached_logo.jpg. Assigning malicious code to the SAVE_CONFIG_TO_DB environment variable then triggers arbitrary code execution [CWE-94].

Critical Impact
Successful exploitation leads to arbitrary code execution and full system control on hosts running vulnerable litellm deployments with Google KMS enabled.

Affected Products

berriai/litellm version 1.34.6
Deployments using the Google KMS secret management feature
Instances exposing the UI_LOGO_PATH configuration surface

Discovery Timeline

2024-06-06 - CVE-2024-4889 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-4889

Vulnerability Analysis

The vulnerability originates in litellm's secret management flow. When Google KMS is configured, the application decodes and evaluates configuration content through Python's eval function without validating the source or contents. Any attacker-controlled data reaching this sink executes as code within the application process.

The attack chain relies on two application behaviors. First, the get_image function fetches the resource referenced by UI_LOGO_PATH and stores it locally as cached_logo.jpg. Second, the secret loader reads the cached artifact as a KMS configuration blob and evaluates values referenced by SAVE_CONFIG_TO_DB.

Root Cause

The root cause is unsafe use of eval on data derived from remote input. The get_image handler treats UI_LOGO_PATH as trusted and writes the fetched bytes to disk without content-type checks, signature validation, or path constraints. The secret manager then trusts the file as a legitimate Google KMS configuration source.

Attack Vector

Exploitation requires high privileges to modify runtime configuration variables and a Google KMS configuration must be active. The attacker points UI_LOGO_PATH to a hostile HTTP server hosting a crafted payload. The application fetches the payload and persists it as cached_logo.jpg. Setting SAVE_CONFIG_TO_DB to a malicious Python expression causes the vulnerable eval call to execute that expression, granting arbitrary code execution in the application context.

No verified public proof-of-concept is available. See the Huntr Bounty Notification for the disclosure record.

Detection Methods for CVE-2024-4889

Indicators of Compromise

Unexpected outbound HTTP requests originating from the litellm process to unfamiliar hosts triggered by get_image calls
Presence or recent modification of cached_logo.jpg containing non-image content such as JSON, YAML, or Python expressions
Runtime changes to the UI_LOGO_PATH or SAVE_CONFIG_TO_DB environment variables that were not part of an approved deployment

Detection Strategies

Inspect the litellm process for child processes such as sh, bash, python, or curl that are spawned during configuration reload events
Alert on file writes to cached_logo.jpg where the file magic bytes do not match a valid image format
Log and review any modification to SAVE_CONFIG_TO_DB and correlate with subsequent process activity

Monitoring Recommendations

Enable audit logging on litellm administrative endpoints and configuration APIs
Forward application, process, and network telemetry from litellm hosts to a centralized analytics platform for correlation
Baseline outbound network destinations from the application and alert on new domains reached by the image fetch routine

How to Mitigate CVE-2024-4889

Immediate Actions Required

Upgrade litellm to a release later than 1.34.6 that removes the eval usage in the secret manager
Disable the Google KMS integration until the application is patched if an upgrade is not immediately feasible
Restrict administrative access to the litellm UI and configuration APIs to trusted operators only

Patch Information

No vendor advisory URL is present in the NVD record. Users should track the upstream berriai/litellm repository for the fixed release and consult the Huntr Bounty Notification for remediation references.

Workarounds

Set UI_LOGO_PATH to a static local asset and prevent runtime modification of the variable
Remove or unset SAVE_CONFIG_TO_DB in production deployments that do not require dynamic configuration persistence
Run the litellm process under a least-privilege service account and apply filesystem restrictions preventing writes outside a dedicated working directory

bash

# Configuration example: disable Google KMS integration and pin the logo path
unset SAVE_CONFIG_TO_DB
export UI_LOGO_PATH="/opt/litellm/static/logo.png"
export GOOGLE_APPLICATION_CREDENTIALS=""