Open WebUI Uncontrolled Resource Consumption vulnerability - open-webui

Description

In version 0.3.32 of open-webui/open-webui, the absence of authentication mechanisms allows any unauthenticated attacker to access the api/v1/utils/code/format endpoint. If a malicious actor sends a POST request with an excessively high volume of content, the server could become completely unresponsive.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 0.3.32

References

• GHSA-chf7-q7m5-fq92
• huntr.com
• CVE-2024-12537
• CWE-400
• CWE-770
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Open WebUI Uncontrolled Resource Consumption vulnerability - CVE-2024-12534
• Uncontrolled resource consumption in braces - CVE-2024-4068
• graphql Uncontrolled Resource Consumption vulnerability - CVE-2023-26144
• Open WebUI Unauthenticated Multipart Boundary Denial of Service (DoS) Vulnerability - Vulnerability

You might also like:

Exploiting Server Version Disclosure

How do hackers hack websites?

CSRF, XXE, and 12 Other Security Acronyms Explained

Tags:

npm

open-webui