Cloud Vulnerability DB
A community-led vulnerabilities database
Vulnerability DatabaseCVE-2024-4889
CVE-2024-4889:
NixOS vulnerability analysis and mitigation
Overview
A code injection vulnerability exists in the berriai/litellm application, version 1.34.6, due to the use of unvalidated input in the eval function within the secret management system (NVD).
Technical details
The vulnerability requires a valid Google KMS configuration file to be exploitable. The issue stems from the use of unvalidated input in the eval function within the secret management system, specifically in the get_image function where the UI_LOGO_PATH variable can be manipulated (NVD).
Impact
If successfully exploited, an attacker can write a malicious Google KMS configuration file to the cached_logo.jpg file and execute arbitrary code by assigning malicious code to the SAVE_CONFIG_TO_DB environment variable, potentially leading to full system control (NVD).
Exploitability
The vulnerability is contingent upon the use of the Google KMS feature and requires a valid Google KMS configuration file to be exploitable (NVD).
Additional resources
Source: This report was generated using AI
Related NixOS vulnerabilities:
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Additional Wiz resources
Get a personalized demo
Ready to see Wiz in action?
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management