mirror of
https://github.com/BerriAI/litellm.git
synced 2026-09-14 23:21:35 +00:00
8bbc61e03c
* fix: patch Host-header auth bypass in get_request_route Starlette reconstructs request.url from the Host header. A malformed Host like `localhost/?x=1` causes Starlette to build the full URL as `http://localhost/?x=1/health`, which url-parses to path="/". Since "/" is in LiteLLMRoutes.public_routes, all protected routes became reachable without authentication. Fix: read scope["path"] (set by uvicorn from the HTTP request line, not derivable from headers) instead of request.url.path. Sub-path deployments are handled via scope["app_root_path"] / scope["root_path"], mirroring Starlette's own base_url construction logic. Affected variants confirmed fixed: Host: localhost/?x=1 Host: localhost:4000/?x=1 Host: localhost/#test Host: localhost:4000/#test Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com> * style: reduce comments in route fix Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com> * fix: block credential fields in RAG ingest vector_store options Credential fields (vertex_credentials, aws_access_key_id, api_key, etc.) in ingest_options.vector_store are now rejected at the API boundary with a 400 error. Credentials must be configured server-side. Previously any authenticated user could supply a vertex_credentials dict with type=external_account pointing credential_source.file at an arbitrary path (e.g. /proc/1/environ) and token_url at an attacker-controlled server. google-auth's identity_pool.Credentials refresh() would read the file and POST its contents to the attacker. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com> * fix: block /key/update self-escalation by assigned users Non-admin users who were assigned a key (created_by != caller) could update any non-budget field — models, rpm_limit, guardrails, etc. — without admin authorization, allowing privilege self-escalation. Gate: only the key creator (created_by == caller) may edit their own key without admin check; budget changes always require admin regardless of creator status. All other callers must pass _check_key_admin_access. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com> * fix: block user-controlled api_base in RAG ingest vector_store options A user-supplied api_base in ingest_options.vector_store caused the server to forward its configured provider credentials (Gemini, OpenAI) to an attacker-controlled endpoint via SSRF. Add api_base to the blocked credential params set alongside api_key and the existing credential fields. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com> * fix: restrict /utils/transform_request to PROXY_ADMIN and apply body safety check Any authenticated internal_user could POST arbitrary provider config (aws_sts_endpoint, api_base, etc.) to /utils/transform_request and have the server forward its credentials to an attacker-controlled endpoint. - Gate the endpoint on PROXY_ADMIN role (403 for all other roles) - Call is_request_body_safe() to reject banned params even for admins - Convert ValueError from safety check to HTTP 400 Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com> * fix: apply banned-param check to /utils/transform_request Without is_request_body_safe(), any authenticated user could pass aws_sts_endpoint, api_base, or aws_web_identity_token to /utils/transform_request and have the server forward its configured provider credentials to an attacker-controlled endpoint during SDK credential resolution. Applies the same banned-param blocklist already used by LLM endpoints. Endpoint remains accessible to all authenticated users. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com> * fix: block SSRF via api_base in /prompts/test dotprompt YAML frontmatter Any frontmatter key not in ["model","input","output"] flowed into optional_params and was merged into the LLM call data dict, bypassing is_request_body_safe. An attacker with any bearer key could set api_base in YAML to redirect the outbound LLM request — including the provider API key — to an attacker-controlled host. Fix: call is_request_body_safe on the constructed data dict after optional_params are merged, before invoking ProxyBaseLLMRequestProcessing. ValueError from the banned-param check is surfaced as HTTP 400. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com> * Update litellm/proxy/rag_endpoints/endpoints.py Co-authored-by: veria-ai[bot] <224490171+veria-ai[bot]@users.noreply.github.com> * fix: coerce nested config strings before banned-param check _NESTED_CONFIG_KEYS descent used isinstance(nested, dict) which silently skipped litellm_embedding_config when delivered as a JSON string via multipart/form-data. Banned params (api_base, aws_sts_endpoint, etc.) nested inside the stringified value were invisible to is_request_body_safe. _NESTED_METADATA_KEYS already used _coerce_metadata_to_dict which parses JSON strings before checking. Apply the same coercion to _NESTED_CONFIG_KEYS. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com> * fix: replace substring match with prefix match in is_llm_api_route mapped_pass_through_routes used `_llm_passthrough_route in route` (substring) so any admin-only path whose URL contained a provider name (openai, anthropic, azure, bedrock, etc.) was misclassified as an LLM API route and bypassed the admin gate in non_proxy_admin_allowed_routes_check. Confirmed live: non-admin key could GET /credentials/by_name/openai (read masked provider API key) and DELETE /credentials/openai (delete credential). Fix: use exact match or startswith(prefix + "/") — the same pattern used everywhere else in RouteChecks — so only routes that actually start with a passthrough prefix are allowed through. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com> * fix: stabilize PR #27878 test failures - key_management_endpoints: extend can_skip_admin_check to team keys so team members with /key/update permission can update non-budget fields. can_team_member_execute_key_management_endpoint already validates team membership + permission and raises if unauthorized; reaching the admin check on a team key means the caller was authorized. - test: set created_by on mock key in test_update_key_non_budget_fields_allowed_for_internal_user so caller_is_creator resolves correctly (MagicMock default ≠ user_id). - auth_utils.get_request_route: guard against non-dict request.scope (e.g. MagicMock in unit tests) to prevent a MagicMock leaking into UserAPIKeyAuth.request_route and failing Pydantic validation. - ci: assign test_multipart_bypass_repro.py to the proxy-runtime shard in test-unit-proxy-db.yml to satisfy the shard-coverage check. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com> * fix(lint): add explicit str() cast in get_request_route for MyPy scope.get() returns Any|None which MyPy cannot coerce to str implicitly. Wrap both scope.get() calls in str() to satisfy the type checker. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com> * fix: guard bare-/ root_path strip + make total_spend migration idempotent auth_utils.get_request_route: when Starlette sets scope["app_root_path"] to "/" (e.g. behind some middleware), the old stripping logic would remove the leading slash from every path ("/team/new" → "team/new"), breaking route matching and causing auth to misclassify protected routes. Skip stripping when root_path is bare "/". migration: add IF NOT EXISTS to total_spend ALTER TABLE so the migration is safe to replay when a prior partial run already created the column. Without this guard, prisma migrate deploy fails on CI DBs that were partially migrated, causing all subsequent DB operations (including /team/new) to 500. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com> * fix: require creator still owns key for personal-key bypass in /key/update caller_is_creator now requires both created_by == caller AND user_id == caller. Previously checking only created_by let a demoted admin who originally created a key for another user continue editing non-budget fields on it after reassignment, bypassing _check_key_admin_access. Adds regression test: creator whose key was reassigned is blocked (403). Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com> * fix: extract auth checks to fix PLR0915 + broaden max_budget assertion internal_user_endpoints._update_single_user_helper exceeded 50 statements (PLR0915). Extract authorization checks into _check_user_update_authz helper to bring statement count under the limit. test_validate_max_budget: assert "negative" (substring of both the local "cannot be negative" and the CI "non-negative finite number" messages) so the test is stable regardless of which exact wording the function uses. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com> Co-authored-by: veria-ai[bot] <224490171+veria-ai[bot]@users.noreply.github.com> |
||
|---|---|---|
| .. | ||
| 20260108_add_user_email_lower_idx | ||
| 20250326162113_baseline | ||
| 20250326171002_add_daily_user_table | ||
| 20250327180120_add_api_requests_to_daily_user_table | ||
| 20250329084805_new_cron_job_table | ||
| 20250331215456_track_success_and_failed_requests_daily_agg_table | ||
| 20250411215431_add_managed_file_table | ||
| 20250412081753_team_member_permissions | ||
| 20250415151647_add_cache_read_write_tokens_daily_spend_transactions | ||
| 20250415191926_add_daily_team_table | ||
| 20250416115320_add_tag_table_to_db | ||
| 20250416151339_drop_tag_uniqueness_requirement | ||
| 20250416185146_add_allowed_routes_litellm_verification_token | ||
| 20250425182129_add_session_id | ||
| 20250430193429_add_managed_vector_stores | ||
| 20250507161526_add_mcp_table_to_db | ||
| 20250507161527_add_health_check_fields_to_mcp_servers | ||
| 20250507184818_add_mcp_key_team_permission_mgmt | ||
| 20250508072103_add_status_to_spendlogs | ||
| 20250509141545_use_big_int_for_daily_spend_tables | ||
| 20250510142544_add_session_id_index_spend_logs | ||
| 20250514142245_add_guardrails_table | ||
| 20250522223020_managed_object_table | ||
| 20250526154401_allow_null_entity_id | ||
| 20250528185438_add_vector_stores_to_object_permissions | ||
| 20250603210143_cascade_budget_changes | ||
| 20250618225828_add_health_check_table | ||
| 20250625145206_cascade_budget_and_loosen_managed_file_json | ||
| 20250625213625_add_status_to_managed_object_table | ||
| 20250707212517_add_mcp_info_column_mcp_servers | ||
| 20250707230009_add_mcp_namespaced_tool_name | ||
| 20250711220620_add_stdio_mcp | ||
| 20250718125714_add_litellm_params_to_vector_stores | ||
| 20250802162330_prompt_table | ||
| 20250806095134_rename_alias_to_server_name_mcp_table | ||
| 20250918083359_drop_spec_version_column_from_mcp_table | ||
| 20250926194702_unnamed_migration | ||
| 20251003165142_add_allowed_tools_to_mcp | ||
| 20251003190954_extra_headers_to_mcp_table | ||
| 20251006143948_add_mcp_tool_permissions | ||
| 20251011084309_add_tag_table | ||
| 20251023141814_add_search_tool_table | ||
| 20251031181430_add_cache_config_table | ||
| 20251101131415_add_managed_vector_store_index_table | ||
| 20251103072422_add_static_headers | ||
| 20251104220043_add_credentials_to_mcp_servers | ||
| 20251113000000_add_project_table | ||
| 20251113000001_add_project_fields | ||
| 20251114173537_add_request_id_to_daily_tag_spend | ||
| 20251114180624_Add_org_usage_table | ||
| 20251114182247_agents_table | ||
| 20251119131227_add_prompt_versioning | ||
| 20251122125322_Add organization_id to spend logs | ||
| 20251204124859_add_end_user_spend_table | ||
| 20251204142718_add_agent_permissions | ||
| 20251209112246_add_ui_settings_table | ||
| 20251210125210_add_storage_backend_to_managed_files | ||
| 20251210205007_add_daily_agent_spend_table | ||
| 20251211100212_schema_sync | ||
| 20251219110931_add_deleted_keys_and_deleted_teams_tables | ||
| 20251220144550_schema_update | ||
| 20260102131258_add_metadata_urls_to_mcp_servers | ||
| 20260105151539_add_allow_all_keys_to_mcp_servers | ||
| 20260106155622_add_endpoint_to_daily_activity_tables | ||
| 20260107111013_add_router_settings_to_keys_teams | ||
| 20260116142756_update_deleted_keys_teams_table_routing_settings | ||
| 20260123131407_add_policy_tables_and_policies_field | ||
| 20260131150814_add_team_user_to_vector_stores | ||
| 20260203120000_add_deprecated_verification_token_table | ||
| 20260205091235_allow_team_guardrail_config | ||
| 20260205144610_add_soft_budget_to_team_table | ||
| 20260207093506_add_available_on_public_internet_to_mcp_servers | ||
| 20260207110613_add_soft_budget_to_deleted_teams_table | ||
| 20260209085821_add_verificationtoken_indexes | ||
| 20260212103349_adjust_tags_policy_table | ||
| 20260212143306_add_access_group_table | ||
| 20260213105436_add_managed_vector_store_table | ||
| 20260213170952_access_group_change_to_model_name | ||
| 20260214094754_schema_sync | ||
| 20260214163027_add_pipeline_to_policy_table | ||
| 20260214185341_object_permissions_for_end_users | ||
| 20260218231534_add_last_active_to_key_table | ||
| 20260219105005_add_project_id_to_deleted_keys | ||
| 20260219181415_baseline_diff | ||
| 20260220124742_add_spec_path_to_mcp_servers | ||
| 20260220153844_add_composite_index_aggregate_tables | ||
| 20260221000000_ensure_project_id_verification_token | ||
| 20260221183800_add_policy_versioning | ||
| 20260222000000_add_batch_processed_to_managed_object_table | ||
| 20260224201417_spend_logs_request_duration | ||
| 20260224203854_add_agent_object_permissions_table | ||
| 20260226000000_add_blocked_tools_to_object_permission | ||
| 20260226120000_add_spend_log_tool_index | ||
| 20260226202727_add_agent_id_to_delete_keys | ||
| 20260228000000_add_claude_code_plugin_table | ||
| 20260228100000_add_spend_logs_composite_index | ||
| 20260228110000_mcp_default_public_internet_true | ||
| 20260228170127_support_team_based_guardrails | ||
| 20260303000000_update_tool_table_policies | ||
| 20260304175016_add_spend_to_agent_table | ||
| 20260305000000_add_agent_headers | ||
| 20260305000000_add_rate_limits_to_agents | ||
| 20260306175056_add_configs_override_table | ||
| 20260306233848_schema_sync | ||
| 20260309000000_add_mcp_approval_status | ||
| 20260309000001_add_mcp_source_url | ||
| 20260312124619_schema_sync | ||
| 20260318140652_add_index_to_team_table | ||
| 20260319000000_restore_mcp_approval_fields | ||
| 20260321000000_add_mcp_toolsets | ||
| 20260331000000_add_prompt_environment_and_created_by | ||
| 20260401000000_add_budget_limits | ||
| 20260401000000_add_team_member_model_scope | ||
| 20260414140000_add_mcp_server_instructions | ||
| 20260415120000_health_check_latest_per_model_index | ||
| 20260418000000_add_adaptive_router_tables | ||
| 20260421120000_add_memory_table | ||
| 20260421135425_add_team_membership_total_spend | ||
| 20260429120000_search_tools_on_object_permission | ||
| 20260429161855_workflow_runs_tables | ||
| 20260501195714_managed_resource_team_owner | ||
| 20260513120000_add_delegate_auth_to_upstream_to_mcp_servers | ||
| migration_lock.toml | ||