Critical · published April 10, 2024
🔥 Who knew that a seemingly harmless template could turn into a full-blown disaster? A Server-Side Template Injection (SSTI) vulnerability in BerriAI/litellm allows malicious attackers to execute arbitrary code through the `/completions` endpoint! 🚨 Think of it like a restaurant that doesn’t check the ingredients of the meals it serves. A sneaky chef could swap in toxic ingredients, turning a delightful dish into a health hazard! In this case, the `chat_template` parameter is processed without proper sanitization, leaving the kitchen wide open for trouble. This vulnerability could lead attackers straight into the server, allowing them to run arbitrary code — potentially altering, deleting, or stealing sensitive data at will. The consequences could be absolutely devastating, jeopardizing not just the application but also the safety of users' information.
Think of it like a restaurant that doesn’t check the ingredients of the meals it serves. A sneaky chef could swap in toxic ingredients, turning a delightful dish into a health hazard! In this case, the `chat_template` parameter is processed without proper sanitization, leaving the kitchen wide open for trouble. This Server-Side Template Injection vulnerability arises from the `hf_chat_template` method processing the `chat_template` parameter from the `tokenizer_config.json` file via the Jinja template engine without proper sanitization, making it susceptible to code injection.
This vulnerability could lead attackers straight into the server, allowing them to run arbitrary code — potentially altering, deleting, or stealing sensitive data at will. The consequences could be absolutely devastating, jeopardizing not just the application but also the safety of users' information. Immediate action is crucial! Patch to the latest version as soon as it's available and ensure that the `tokenizer_config.json` file is properly sanitized before processing to mitigate risks. Review your server’s template handling practices to tighten security further. Don't fret! You can fix this by following the steps above and locking down your application — security hero status: activated! 🛡️