Open WebUI Uncontrolled Resource Consumption vulnerability
In version 0.3.32 of open-webui/open-webui, the absence of authentication mechanisms allows any unauthenticated attacker to access the `api/v1/utils/code/format` endpoint. If a malicious actor sends a POST request with an excessively high volume of content, the server could become completely unresponsive. This could lead to severe performance issues, causing the server to become unresponsive or experience significant degradation, ultimately resulting in service interruptions for legitimate users.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-12537US | — | Exploit | ||
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | ||||
references
External citations — patches, advisories, analysis.
- https://github.com/advisories/GHSA-chf7-q7m5-fq92ADVISORY
- https://github.com/open-webui/open-webuiPACKAGE
- https://github.com/open-webui/open-webui/blob/e8babe62bc8e466be0367703fd062a981f5c2394/src/lib/apis/utils/index.ts#L25-L56WEB
- https://huntr.com/bounties/edabd06c-acc0-428c-a481-271f333755bcWEB
- https://nvd.nist.gov/vuln/detail/CVE-2024-12537ADVISORY
- https://pypi.org/project/open-webuiPACKAGE
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan