LiteLLM Server-Side Request Forgery inside Custom Guardrails

🔍 Vulnerability Mechanism

LiteLLM custom guardrails expose a code execution sandbox with access to http_get() and http_request() helper functions. The URL check is limited to verifying standard syntax (e.g. valid scheme and host).

---

💥 Exploitation Path

There are no network blocklists for private IP ranges (RFC1918), loopback, or link-local targets. An attacker executing custom code inside the guardrail environment can perform full-response SSRF scans against local ports or query cloud credentials via the AWS metadata service at http://169.254.169.254/latest/meta-data/.