Command Injection in BerriAI LiteLLM MCP preview endpoints

This repository is a standalone Python proof-of-concept exploit for CVE-2026-42271, an authenticated OS command injection vulnerability in BerriAI LiteLLM MCP stdio test endpoints. The repo contains 8 files: documentation in README.md and docs/advisory.md, a reproducible vulnerable lab in docker-compose.yml, the exploit implementation in exploit/exploit.py, payload helpers in exploit/payload.py, a minimal requirements.txt, and a screenshots placeholder directory. The main exploit logic is in exploit/exploit.py. It uses requests to send authenticated POST requests to either /mcp-rest/test/tools/list or /mcp-rest/test/connection on a target LiteLLM instance. The script builds a JSON body with transport="stdio" and attacker-controlled command/args values, relying on the vulnerable server behavior of spawning the supplied command as a subprocess. The exploit supports selecting the endpoint, setting a target URL and API key, routing through an HTTP proxy, adjusting timeout, and running in an interactive blind-shell mode where each entered command is sent as a new exploit request. The helper module exploit/payload.py generates reusable payloads. It includes functions for generic payload creation, arbitrary shell command execution via bash -c, reverse shell generation, environment extraction by reading /proc/1/environ, and file-read payloads that redirect sensitive file contents into writable target-side files. The code explicitly notes that MCP SDK environment isolation prevents simple env dumping from revealing parent process secrets, so it instead targets /proc/1/environ to recover values such as LITELLM_MASTER_KEY. The exploit’s capabilities are substantial: authenticated remote code execution, blind interactive command execution, reverse shell payload generation, reading sensitive files, and extracting process environment variables. The README and code indicate that any valid API key is sufficient because the vulnerable endpoints lack proper role checks; in the default Docker deployment, the LiteLLM process runs as root, so successful exploitation yields root-level command execution inside the container. The docker-compose.yml file provides a reproducible environment with a pinned vulnerable LiteLLM v1.82.6 image on port 4000 and an optional fixed v1.83.7 image on port 4001. This confirms the repository’s purpose is both demonstration and reproducible exploitation of the vulnerability rather than mere detection. Overall, this is a real operational PoC exploit for authenticated web/network-based RCE against vulnerable LiteLLM deployments.