scriptoriumadmin/litellm
1
0
Fork 0
mirror of https://github.com/BerriAI/litellm.git synced 2026-09-28 01:32:17 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 43
litellm/litellm/proxy/_experimental/out/api-reference/index.html
user 0d4875dec9
chore(security): close two unaddressed SSRF cases 
Two SSRF findings were OPEN with no in-flight fix; both are closed
now using narrow defenses that key off existing trust boundaries.

VERIA-6 (Milvus ``litellm_embedding_config``):
``is_request_body_safe`` already blocks ``api_base`` / ``api_key`` /
``langfuse_host`` / ``s3_endpoint_url`` / etc. at the *root* of the
request body, gated by an admin opt-in (``allow_client_side_credentials``
or per-deployment ``configurable_clientside_auth_params``). The bug is
that the Milvus vector-store transformer unpacks
``litellm_embedding_config`` into ``litellm.embedding(**embedding_config)``,
so a caller can smuggle the same banned params in via nesting and bypass
the check. Fix: ``is_request_body_safe`` now recurses into a known list
of nested-config dicts (``litellm_embedding_config`` for now) and applies
the same banned-param check with the same admin opt-in. Admin-side
vector-store config flows through ``litellm_params`` rather than the
request body, so it's unaffected.

VERIA-51 (polling URLs returned by upstream APIs):
Azure DALL-E 2, Azure Document Intelligence, and Black Forest Labs
all blindly fetched a polling URL returned by the upstream and
attached the operator's API key to the request. A compromised upstream
or a future API contract change could redirect credentials anywhere.
New ``url_utils.assert_same_origin(candidate, expected)`` helper checks
scheme, host (case-insensitive), and port (with default-port
normalization). Applied at all five polling sites: Azure DALL-E
sync+async, Azure DI sync+async, BFL image generation sync+async, BFL
image edit sync+async. Cross-origin polling URLs now raise rather than
forward credentials. The Azure DALL-E ``Expected 'status' in response``
exception no longer reflects the raw response body — that path turned
Blind SSRF into Full-Read SSRF for the limited window before the
origin check fully closed it.

Tests: 7 ``assert_same_origin`` unit tests, 6 ``is_request_body_safe``
nested-config tests, 5 polling-site rejection tests + 1 same-origin
sanity check.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-01 18:43:47 +00:00

1 line
No EOL
16 KiB
HTML
Raw Blame History

<!DOCTYPE html><!--zxkD4_EPlgfKHDTw8O869--><html lang="en"><head><meta charSet="utf-8"/><meta name="viewport" content="width=device-width, initial-scale=1"/><link rel="preload" href="/litellm-asset-prefix/_next/static/media/83afe278b6a6bb3c-s.p.3a6ba036.woff2" as="font" crossorigin="" type="font/woff2"/><link rel="stylesheet" href="/litellm-asset-prefix/_next/static/chunks/4e20891f2fd03463.css" data-precedence="next"/><link rel="stylesheet" href="/litellm-asset-prefix/_next/static/chunks/e0cb6755699177c1.css" data-precedence="next"/><link rel="preload" as="script" fetchPriority="low" href="/litellm-asset-prefix/_next/static/chunks/5489ec6b9761f819.js"/><script src="/litellm-asset-prefix/_next/static/chunks/1300460219810c10.js" async=""></script><script src="/litellm-asset-prefix/_next/static/chunks/e96398764f77c728.js" async=""></script><script src="/litellm-asset-prefix/_next/static/chunks/726579f2940c2a2f.js" async=""></script><script src="/litellm-asset-prefix/_next/static/chunks/turbopack-ddedb29a5eb0118f.js" async=""></script><script src="/litellm-asset-prefix/_next/static/chunks/9e09de50158b3159.js" async=""></script><script src="/litellm-asset-prefix/_next/static/chunks/7e5fe5584502da06.js" async=""></script><script src="/litellm-asset-prefix/_next/static/chunks/d96012bcfc98706a.js" async=""></script><script src="/litellm-asset-prefix/_next/static/chunks/dbca964212122d58.js" async=""></script><script src="/litellm-asset-prefix/_next/static/chunks/f7c95eaa060d1f99.js" async=""></script><script src="/litellm-asset-prefix/_next/static/chunks/7f59802b710501d5.js" async=""></script><script src="/litellm-asset-prefix/_next/static/chunks/eea976cf4a05fc92.js" async=""></script><script src="/litellm-asset-prefix/_next/static/chunks/0a6c418370a8c183.js" async=""></script><script src="/litellm-asset-prefix/_next/static/chunks/c2f31fa6e9a867a9.js" async=""></script><script src="/litellm-asset-prefix/_next/static/chunks/996933f13e574998.js" async=""></script><script src="/litellm-asset-prefix/_next/static/chunks/00ff280cdb7d7ee5.js" async=""></script><script src="/litellm-asset-prefix/_next/static/chunks/738c339383c3b4b6.js" async=""></script><script src="/litellm-asset-prefix/_next/static/chunks/e1ddb2a5fb23f5a5.js" async=""></script><script src="/litellm-asset-prefix/_next/static/chunks/0e6dadb6a51341b5.js" async=""></script><script src="/litellm-asset-prefix/_next/static/chunks/673d847ad9c91666.js" async=""></script><script src="/litellm-asset-prefix/_next/static/chunks/7e417dd24c8becd0.js" async=""></script><script src="/litellm-asset-prefix/_next/static/chunks/6c4c97f1ea6e7d77.js" async=""></script><meta name="next-size-adjust" content=""/><title>LiteLLM Dashboard</title><meta name="description" content="LiteLLM Proxy Admin UI"/><link rel="icon" href="/favicon.ico?favicon.1d32c690.ico" sizes="48x48" type="image/x-icon"/><link rel="icon" href="./favicon.ico"/><script src="/litellm-asset-prefix/_next/static/chunks/a6dad97d9634a72d.js" noModule=""></script></head><body class="inter_5972bc34-module__OU16Qa__className"><div hidden=""><!--$--><!--/$--></div><!--$!--><template data-dgst="BAILOUT_TO_CLIENT_SIDE_RENDERING"></template><div class="flex items-center justify-center min-h-screen">Loading...</div><!--/$--><script src="/litellm-asset-prefix/_next/static/chunks/5489ec6b9761f819.js" id="_R_" async=""></script><script>(self.__next_f=self.__next_f||[]).push([0])</script><script>self.__next_f.push([1,"1:\"$Sreact.fragment\"\n2:I[867271,[\"/litellm-asset-prefix/_next/static/chunks/9e09de50158b3159.js\",\"/litellm-asset-prefix/_next/static/chunks/7e5fe5584502da06.js\"],\"default\"]\n3:I[71195,[\"/litellm-asset-prefix/_next/static/chunks/9e09de50158b3159.js\",\"/litellm-asset-prefix/_next/static/chunks/7e5fe5584502da06.js\"],\"default\"]\n4:I[339756,[\"/litellm-asset-prefix/_next/static/chunks/d96012bcfc98706a.js\",\"/litellm-asset-prefix/_next/static/chunks/dbca964212122d58.js\"],\"default\"]\n5:I[837457,[\"/litellm-asset-prefix/_next/static/chunks/d96012bcfc98706a.js\",\"/litellm-asset-prefix/_next/static/chunks/dbca964212122d58.js\"],\"default\"]\n6:I[92825,[\"/litellm-asset-prefix/_next/static/chunks/d96012bcfc98706a.js\",\"/litellm-asset-prefix/_next/static/chunks/dbca964212122d58.js\"],\"ClientSegmentRoot\"]\n7:I[216370,[\"/litellm-asset-prefix/_next/static/chunks/9e09de50158b3159.js\",\"/litellm-asset-prefix/_next/static/chunks/7e5fe5584502da06.js\",\"/litellm-asset-prefix/_next/static/chunks/f7c95eaa060d1f99.js\",\"/litellm-asset-prefix/_next/static/chunks/7f59802b710501d5.js\",\"/litellm-asset-prefix/_next/static/chunks/eea976cf4a05fc92.js\",\"/litellm-asset-prefix/_next/static/chunks/0a6c418370a8c183.js\",\"/litellm-asset-prefix/_next/static/chunks/c2f31fa6e9a867a9.js\",\"/litellm-asset-prefix/_next/static/chunks/996933f13e574998.js\",\"/litellm-asset-prefix/_next/static/chunks/00ff280cdb7d7ee5.js\",\"/litellm-asset-prefix/_next/static/chunks/738c339383c3b4b6.js\",\"/litellm-asset-prefix/_next/static/chunks/e1ddb2a5fb23f5a5.js\",\"/litellm-asset-prefix/_next/static/chunks/0e6dadb6a51341b5.js\"],\"default\"]\nc:I[168027,[],\"default\"]\n:HL[\"/litellm-asset-prefix/_next/static/chunks/4e20891f2fd03463.css\",\"style\"]\n:HL[\"/litellm-asset-prefix/_next/static/chunks/e0cb6755699177c1.css\",\"style\"]\n:HL[\"/litellm-asset-prefix/_next/static/media/83afe278b6a6bb3c-s.p.3a6ba036.woff2\",\"font\",{\"crossOrigin\":\"\",\"type\":\"font/woff2\"}]\n"])</script><script>self.__next_f.push([1,"0:{\"P\":null,\"b\":\"zxkD4-EPlgfKHDTw8O869\",\"c\":[\"\",\"api-reference\"],\"q\":\"\",\"i\":false,\"f\":[[[\"\",{\"children\":[\"(dashboard)\",{\"children\":[\"api-reference\",{\"children\":[\"__PAGE__\",{}]}]}]},\"$undefined\",\"$undefined\",true],[[\"$\",\"$1\",\"c\",{\"children\":[[[\"$\",\"link\",\"0\",{\"rel\":\"stylesheet\",\"href\":\"/litellm-asset-prefix/_next/static/chunks/4e20891f2fd03463.css\",\"precedence\":\"next\",\"crossOrigin\":\"$undefined\",\"nonce\":\"$undefined\"}],[\"$\",\"link\",\"1\",{\"rel\":\"stylesheet\",\"href\":\"/litellm-asset-prefix/_next/static/chunks/e0cb6755699177c1.css\",\"precedence\":\"next\",\"crossOrigin\":\"$undefined\",\"nonce\":\"$undefined\"}],[\"$\",\"script\",\"script-0\",{\"src\":\"/litellm-asset-prefix/_next/static/chunks/9e09de50158b3159.js\",\"async\":true,\"nonce\":\"$undefined\"}],[\"$\",\"script\",\"script-1\",{\"src\":\"/litellm-asset-prefix/_next/static/chunks/7e5fe5584502da06.js\",\"async\":true,\"nonce\":\"$undefined\"}]],[\"$\",\"html\",null,{\"lang\":\"en\",\"children\":[\"$\",\"body\",null,{\"className\":\"inter_5972bc34-module__OU16Qa__className\",\"children\":[\"$\",\"$L2\",null,{\"children\":[\"$\",\"$L3\",null,{\"children\":[\"$\",\"$L4\",null,{\"parallelRouterKey\":\"children\",\"error\":\"$undefined\",\"errorStyles\":\"$undefined\",\"errorScripts\":\"$undefined\",\"template\":[\"$\",\"$L5\",null,{}],\"templateStyles\":\"$undefined\",\"templateScripts\":\"$undefined\",\"notFound\":[[[\"$\",\"title\",null,{\"children\":\"404: This page could not be found.\"}],[\"$\",\"div\",null,{\"style\":{\"fontFamily\":\"system-ui,\\\"Segoe UI\\\",Roboto,Helvetica,Arial,sans-serif,\\\"Apple Color Emoji\\\",\\\"Segoe UI Emoji\\\"\",\"height\":\"100vh\",\"textAlign\":\"center\",\"display\":\"flex\",\"flexDirection\":\"column\",\"alignItems\":\"center\",\"justifyContent\":\"center\"},\"children\":[\"$\",\"div\",null,{\"children\":[[\"$\",\"style\",null,{\"dangerouslySetInnerHTML\":{\"__html\":\"body{color:#000;background:#fff;margin:0}.next-error-h1{border-right:1px solid rgba(0,0,0,.3)}@media (prefers-color-scheme:dark){body{color:#fff;background:#000}.next-error-h1{border-right:1px solid rgba(255,255,255,.3)}}\"}}],[\"$\",\"h1\",null,{\"className\":\"next-error-h1\",\"style\":{\"display\":\"inline-block\",\"margin\":\"0 20px 0 0\",\"padding\":\"0 23px 0 0\",\"fontSize\":24,\"fontWeight\":500,\"verticalAlign\":\"top\",\"lineHeight\":\"49px\"},\"children\":404}],[\"$\",\"div\",null,{\"style\":{\"display\":\"inline-block\"},\"children\":[\"$\",\"h2\",null,{\"style\":{\"fontSize\":14,\"fontWeight\":400,\"lineHeight\":\"49px\",\"margin\":0},\"children\":\"This page could not be found.\"}]}]]}]}]],[]],\"forbidden\":\"$undefined\",\"unauthorized\":\"$undefined\"}]}]}]}]}]]}],{\"children\":[[\"$\",\"$1\",\"c\",{\"children\":[[[\"$\",\"script\",\"script-0\",{\"src\":\"/litellm-asset-prefix/_next/static/chunks/f7c95eaa060d1f99.js\",\"async\":true,\"nonce\":\"$undefined\"}],[\"$\",\"script\",\"script-1\",{\"src\":\"/litellm-asset-prefix/_next/static/chunks/7f59802b710501d5.js\",\"async\":true,\"nonce\":\"$undefined\"}],[\"$\",\"script\",\"script-2\",{\"src\":\"/litellm-asset-prefix/_next/static/chunks/eea976cf4a05fc92.js\",\"async\":true,\"nonce\":\"$undefined\"}],[\"$\",\"script\",\"script-3\",{\"src\":\"/litellm-asset-prefix/_next/static/chunks/0a6c418370a8c183.js\",\"async\":true,\"nonce\":\"$undefined\"}],[\"$\",\"script\",\"script-4\",{\"src\":\"/litellm-asset-prefix/_next/static/chunks/c2f31fa6e9a867a9.js\",\"async\":true,\"nonce\":\"$undefined\"}],[\"$\",\"script\",\"script-5\",{\"src\":\"/litellm-asset-prefix/_next/static/chunks/996933f13e574998.js\",\"async\":true,\"nonce\":\"$undefined\"}],[\"$\",\"script\",\"script-6\",{\"src\":\"/litellm-asset-prefix/_next/static/chunks/00ff280cdb7d7ee5.js\",\"async\":true,\"nonce\":\"$undefined\"}],[\"$\",\"script\",\"script-7\",{\"src\":\"/litellm-asset-prefix/_next/static/chunks/738c339383c3b4b6.js\",\"async\":true,\"nonce\":\"$undefined\"}],[\"$\",\"script\",\"script-8\",{\"src\":\"/litellm-asset-prefix/_next/static/chunks/e1ddb2a5fb23f5a5.js\",\"async\":true,\"nonce\":\"$undefined\"}],[\"$\",\"script\",\"script-9\",{\"src\":\"/litellm-asset-prefix/_next/static/chunks/0e6dadb6a51341b5.js\",\"async\":true,\"nonce\":\"$undefined\"}]],[\"$\",\"$L6\",null,{\"Component\":\"$7\",\"slots\":{\"children\":[\"$\",\"$L4\",null,{\"parallelRouterKey\":\"children\",\"error\":\"$undefined\",\"errorStyles\":\"$undefined\",\"errorScripts\":\"$undefined\",\"template\":[\"$\",\"$L5\",null,{}],\"templateStyles\":\"$undefined\",\"templateScripts\":\"$undefined\",\"notFound\":[[[\"$\",\"title\",null,{\"children\":\"404: This page could not be found.\"}],[\"$\",\"div\",null,{\"style\":\"$0:f:0:1:0:props:children:1:props:children:props:children:props:children:props:children:props:notFound:0:1:props:style\",\"children\":[\"$\",\"div\",null,{\"children\":[[\"$\",\"style\",null,{\"dangerouslySetInnerHTML\":{\"__html\":\"body{color:#000;background:#fff;margin:0}.next-error-h1{border-right:1px solid rgba(0,0,0,.3)}@media (prefers-color-scheme:dark){body{color:#fff;background:#000}.next-error-h1{border-right:1px solid rgba(255,255,255,.3)}}\"}}],[\"$\",\"h1\",null,{\"className\":\"next-error-h1\",\"style\":\"$0:f:0:1:0:props:children:1:props:children:props:children:props:children:props:children:props:notFound:0:1:props:children:props:children:1:props:style\",\"children\":404}],[\"$\",\"div\",null,{\"style\":\"$0:f:0:1:0:props:children:1:props:children:props:children:props:children:props:children:props:notFound:0:1:props:children:props:children:2:props:style\",\"children\":[\"$\",\"h2\",null,{\"style\":\"$0:f:0:1:0:props:children:1:props:children:props:children:props:children:props:children:props:notFound:0:1:props:children:props:children:2:props:children:props:style\",\"children\":\"This page could not be found.\"}]}]]}]}]],[]],\"forbidden\":\"$undefined\",\"unauthorized\":\"$undefined\"}]},\"serverProvidedParams\":{\"params\":{},\"promises\":[\"$@8\"]}}]]}],{\"children\":[\"$L9\",{\"children\":[\"$La\",{},null,false,false]},null,false,false]},null,false,false]},null,false,false],\"$Lb\",false]],\"m\":\"$undefined\",\"G\":[\"$c\",[]],\"S\":true}\n"])</script><script>self.__next_f.push([1,"d:I[347257,[\"/litellm-asset-prefix/_next/static/chunks/d96012bcfc98706a.js\",\"/litellm-asset-prefix/_next/static/chunks/dbca964212122d58.js\"],\"ClientPageRoot\"]\ne:I[191905,[\"/litellm-asset-prefix/_next/static/chunks/9e09de50158b3159.js\",\"/litellm-asset-prefix/_next/static/chunks/7e5fe5584502da06.js\",\"/litellm-asset-prefix/_next/static/chunks/f7c95eaa060d1f99.js\",\"/litellm-asset-prefix/_next/static/chunks/7f59802b710501d5.js\",\"/litellm-asset-prefix/_next/static/chunks/eea976cf4a05fc92.js\",\"/litellm-asset-prefix/_next/static/chunks/0a6c418370a8c183.js\",\"/litellm-asset-prefix/_next/static/chunks/c2f31fa6e9a867a9.js\",\"/litellm-asset-prefix/_next/static/chunks/996933f13e574998.js\",\"/litellm-asset-prefix/_next/static/chunks/00ff280cdb7d7ee5.js\",\"/litellm-asset-prefix/_next/static/chunks/738c339383c3b4b6.js\",\"/litellm-asset-prefix/_next/static/chunks/e1ddb2a5fb23f5a5.js\",\"/litellm-asset-prefix/_next/static/chunks/0e6dadb6a51341b5.js\",\"/litellm-asset-prefix/_next/static/chunks/673d847ad9c91666.js\",\"/litellm-asset-prefix/_next/static/chunks/7e417dd24c8becd0.js\",\"/litellm-asset-prefix/_next/static/chunks/6c4c97f1ea6e7d77.js\"],\"default\"]\n11:I[897367,[\"/litellm-asset-prefix/_next/static/chunks/d96012bcfc98706a.js\",\"/litellm-asset-prefix/_next/static/chunks/dbca964212122d58.js\"],\"OutletBoundary\"]\n12:\"$Sreact.suspense\"\n14:I[897367,[\"/litellm-asset-prefix/_next/static/chunks/d96012bcfc98706a.js\",\"/litellm-asset-prefix/_next/static/chunks/dbca964212122d58.js\"],\"ViewportBoundary\"]\n16:I[897367,[\"/litellm-asset-prefix/_next/static/chunks/d96012bcfc98706a.js\",\"/litellm-asset-prefix/_next/static/chunks/dbca964212122d58.js\"],\"MetadataBoundary\"]\n9:[\"$\",\"$1\",\"c\",{\"children\":[null,[\"$\",\"$L4\",null,{\"parallelRouterKey\":\"children\",\"error\":\"$undefined\",\"errorStyles\":\"$undefined\",\"errorScripts\":\"$undefined\",\"template\":[\"$\",\"$L5\",null,{}],\"templateStyles\":\"$undefined\",\"templateScripts\":\"$undefined\",\"notFound\":\"$undefined\",\"forbidden\":\"$undefined\",\"unauthorized\":\"$undefined\"}]]}]\na:[\"$\",\"$1\",\"c\",{\"children\":[[\"$\",\"$Ld\",null,{\"Component\":\"$e\",\"serverProvidedParams\":{\"searchParams\":{},\"params\":\"$0:f:0:1:1:children:0:props:children:1:props:serverProvidedParams:params\",\"promises\":[\"$@f\",\"$@10\"]}}],[[\"$\",\"script\",\"script-0\",{\"src\":\"/litellm-asset-prefix/_next/static/chunks/673d847ad9c91666.js\",\"async\":true,\"nonce\":\"$undefined\"}],[\"$\",\"script\",\"script-1\",{\"src\":\"/litellm-asset-prefix/_next/static/chunks/7e417dd24c8becd0.js\",\"async\":true,\"nonce\":\"$undefined\"}],[\"$\",\"script\",\"script-2\",{\"src\":\"/litellm-asset-prefix/_next/static/chunks/6c4c97f1ea6e7d77.js\",\"async\":true,\"nonce\":\"$undefined\"}]],[\"$\",\"$L11\",null,{\"children\":[\"$\",\"$12\",null,{\"name\":\"Next.MetadataOutlet\",\"children\":\"$@13\"}]}]]}]\nb:[\"$\",\"$1\",\"h\",{\"children\":[null,[\"$\",\"$L14\",null,{\"children\":\"$L15\"}],[\"$\",\"div\",null,{\"hidden\":true,\"children\":[\"$\",\"$L16\",null,{\"children\":[\"$\",\"$12\",null,{\"name\":\"Next.Metadata\",\"children\":\"$L17\"}]}]}],[\"$\",\"meta\",null,{\"name\":\"next-size-adjust\",\"content\":\"\"}]]}]\n8:\"$0:f:0:1:1:children:0:props:children:1:props:serverProvidedParams:params\"\n"])</script><script>self.__next_f.push([1,"f:{}\n10:\"$0:f:0:1:1:children:0:props:children:1:props:serverProvidedParams:params\"\n"])</script><script>self.__next_f.push([1,"15:[[\"$\",\"meta\",\"0\",{\"charSet\":\"utf-8\"}],[\"$\",\"meta\",\"1\",{\"name\":\"viewport\",\"content\":\"width=device-width, initial-scale=1\"}]]\n"])</script><script>self.__next_f.push([1,"18:I[27201,[\"/litellm-asset-prefix/_next/static/chunks/d96012bcfc98706a.js\",\"/litellm-asset-prefix/_next/static/chunks/dbca964212122d58.js\"],\"IconMark\"]\n13:null\n17:[[\"$\",\"title\",\"0\",{\"children\":\"LiteLLM Dashboard\"}],[\"$\",\"meta\",\"1\",{\"name\":\"description\",\"content\":\"LiteLLM Proxy Admin UI\"}],[\"$\",\"link\",\"2\",{\"rel\":\"icon\",\"href\":\"/favicon.ico?favicon.1d32c690.ico\",\"sizes\":\"48x48\",\"type\":\"image/x-icon\"}],[\"$\",\"link\",\"3\",{\"rel\":\"icon\",\"href\":\"./favicon.ico\"}],[\"$\",\"$L18\",\"4\",{}]]\n"])</script></body></html>
Reference in a new issue View git blame Copy permalink