mirror of
https://github.com/BerriAI/litellm.git
synced 2026-09-20 00:11:50 +00:00
0d4875dec9
Two SSRF findings were OPEN with no in-flight fix; both are closed now using narrow defenses that key off existing trust boundaries. VERIA-6 (Milvus ``litellm_embedding_config``): ``is_request_body_safe`` already blocks ``api_base`` / ``api_key`` / ``langfuse_host`` / ``s3_endpoint_url`` / etc. at the *root* of the request body, gated by an admin opt-in (``allow_client_side_credentials`` or per-deployment ``configurable_clientside_auth_params``). The bug is that the Milvus vector-store transformer unpacks ``litellm_embedding_config`` into ``litellm.embedding(**embedding_config)``, so a caller can smuggle the same banned params in via nesting and bypass the check. Fix: ``is_request_body_safe`` now recurses into a known list of nested-config dicts (``litellm_embedding_config`` for now) and applies the same banned-param check with the same admin opt-in. Admin-side vector-store config flows through ``litellm_params`` rather than the request body, so it's unaffected. VERIA-51 (polling URLs returned by upstream APIs): Azure DALL-E 2, Azure Document Intelligence, and Black Forest Labs all blindly fetched a polling URL returned by the upstream and attached the operator's API key to the request. A compromised upstream or a future API contract change could redirect credentials anywhere. New ``url_utils.assert_same_origin(candidate, expected)`` helper checks scheme, host (case-insensitive), and port (with default-port normalization). Applied at all five polling sites: Azure DALL-E sync+async, Azure DI sync+async, BFL image generation sync+async, BFL image edit sync+async. Cross-origin polling URLs now raise rather than forward credentials. The Azure DALL-E ``Expected 'status' in response`` exception no longer reflects the raw response body — that path turned Blind SSRF into Full-Read SSRF for the limited window before the origin check fully closed it. Tests: 7 ``assert_same_origin`` unit tests, 6 ``is_request_body_safe`` nested-config tests, 5 polling-site rejection tests + 1 same-origin sanity check. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| test_auth_checks.py | ||
| test_auth_exception_handler.py | ||
| test_auth_hot_path_network_requests.py | ||
| test_auth_utils.py | ||
| test_cli_auth.py | ||
| test_custom_auth_end_user_budget.py | ||
| test_handle_jwt.py | ||
| test_info_routes.py | ||
| test_litellm_license.py | ||
| test_login_utils.py | ||
| test_mcp_ip_filtering.py | ||
| test_model_checks.py | ||
| test_model_checks_fallbacks.py | ||
| test_multi_budget_windows.py | ||
| test_object_permission_loading.py | ||
| test_onboarding.py | ||
| test_organization_budget_enforcement.py | ||
| test_password_hashing.py | ||
| test_route_checks.py | ||
| test_team_member_budget.py | ||
| test_unmapped_model_budget_enforcement.py | ||
| test_user_api_key_auth.py | ||