BerriAI LiteLLM Proxy MCP Test Endpoint Command Execution

Description

This module exploits CVE-2026-42271, a command execution vulnerability in the BerriAI LiteLLM proxy. The MCP "test" REST endpoints (POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list), used by the admin UI to preview an MCP server before saving it, accept a full server configuration in the request body. When the supplied transport is "stdio", LiteLLM builds an MCP client that spawns the provided command with its args as a subprocess on the proxy host.

On affected versions both endpoints are gated only by user_api_key_auth and the stdio command is unrestricted, so any caller holding a valid virtual key - including a low-privilege, non-admin key - can reach the spawn path and run arbitrary commands as the LiteLLM proxy process. LiteLLM 1.83.7 fixed this with two controls: it requires the PROXY_ADMIN role on both endpoints (a non-admin key now receives HTTP 403), and it restricts the stdio command to an allowlist of interpreters (deno, docker, node, npx, python, python3, uvx), so an arbitrary command such as /bin/sh is rejected with HTTP 422 regardless of role.

Affected versions are 1.74.2 through 1.83.6 (fixed in 1.83.7). This module targets the privilege boundary the CVE describes and expects a non-admin APIKEY. When chained with the Starlette host-header authentication bypass (CVE-2026-48710) the same primitive becomes pre-authentication; that bypass is out of scope for this module, which requires a valid virtual key.

The command runs blind: the spawned process is not an MCP server, so the endpoint reports a connection failure after the command has already executed. Use a payload that calls back (for example a reverse shell or a fetched stager) rather than one whose output is read from the response.