litellm - 💡(How to fix) Fix Security: SSRF via api_base parameter + RCE via guardrail missing sandbox [2 comments, 2 participants]

TL;DR

To address the identified security vulnerabilities, implement URL validation and private IP blocking for the api_base parameter, and apply a sandbox to the production CustomCodeGuardrail by clearing __builtins__ and applying FORBIDDEN_PATTERNS.

Guidance

• Implement URL validation to ensure api_base only accepts expected and safe URLs, blocking any private IP addresses to prevent SSRF attacks.
• Apply the same sandboxing used in the test endpoint to the production CustomCodeGuardrail, specifically by setting __builtins__ to an empty dictionary and enforcing FORBIDDEN_PATTERNS to prevent RCE.
• Review the codebase for any similar instances where user-inputted data is used to construct URLs or execute code without proper validation and sandboxing.
• Consider implementing additional security measures such as input validation, rate limiting, and monitoring for suspicious activity to further mitigate potential attacks.

Example

# Example of setting __builtins__ to an empty dictionary for sandboxing
exec_globals = {}
exec_globals['__builtins__'] = {}
exec(compile(self.custom_code, '<guardrail>', 'exec'), exec_globals)

Notes

The provided fixes directly address the mentioned vulnerabilities but a comprehensive security audit is recommended to identify any other potential issues within the codebase.

Recommendation

Apply workaround by implementing the suggested fixes for URL validation and sandboxing to immediately mitigate the identified vulnerabilities.