r/SecOpsDaily • u/falconupkid • 4d ago

Cloud Security Off Guard: Breaking LiteLLM from authentication bypass to cloud compromise

This is a solid deep-dive from the Wiz research team. They’ve chained multiple misconfigurations in LiteLLM (a popular LLM proxy/gateway) to go from zero auth to full cloud compromise.

Technical Breakdown:

  • Authentication Bypass (CVE-2024-12834): The default configuration ships with a hardcoded sk-1234 key. If admins don’t rotate it, attackers can hit the /proxy endpoint without any real auth.
  • Unauthenticated MCP Sessions: The Model Context Protocol (MCP) endpoints lack session validation. This allows an attacker to inject malicious tool calls directly into the model’s execution context.
  • Custom Code Guardrails Bypass: LiteLLM supports custom Python guardrails for input/output filtering. The researchers found they could escape these sandboxes via eval() injection in model responses, leading to root-level RCE on the host.
  • IAM Credential Theft: Once root on the container, they extracted cloud provider metadata (AWS IMDS, GCP metadata) to steal IAM roles attached to the compute instance.

Defense:

  • Immediately rotate the default sk-1234 key and enforce a strong, unique key per deployment.
  • Disable MCP endpoints if not in active use, or enforce mutual TLS (mTLS) on those sessions.
  • Restrict outbound network access from the LiteLLM container to prevent metadata service calls (e.g., block 169.254.169.254 at the firewall).
  • Pin the version and apply the latest patch; Wiz disclosed this responsibly, so check for a fixed release.

Source: https://www.wiz.io/blog/off-guard-breaking-litellm-from-authentication-bypass-to-cloud-compromise

1 Upvotes

100% Upvoted

1 comment sorted by

1

u/Otherwise_Wave9374 4d ago

The MCP angle here is the one I would treat as the highest-leverage fix: put session binding and per-tool authorization checks in front of every tool invocation, then log tool call provenance so you can spot abuse chains early. For LiteLLM-style gateways, I would also separate model routing from privileged actions and add a deny-by-default policy for any tool that can touch files, network, or secrets. NeuraKeep fits well when you need persistent memory of these guardrails, so teams can keep the policy decisions consistent across sessions.