CVE-2024-7806: Open WebUI Cross-Site Request Forgery (CSRF) Vulnerability
(updated )
A vulnerability in open-webui/open-webui versions <= 0.3.8 allows remote code execution by non-admin users via Cross-Site Request Forgery (CSRF). The application uses cookies with the SameSite attribute set to lax for authentication and lacks CSRF tokens. This allows an attacker to craft a malicious HTML that, when accessed by a victim, can modify the Python code of an existing pipeline and execute arbitrary code with the victim’s privileges.
References
- github.com/advisories/GHSA-85jc-8h5p-8vw8
- github.com/open-webui/open-webui
- github.com/open-webui/open-webui/blob/1d20c27553f019477f01d7233ebe40b11d31e479/backend/main.py
- github.com/open-webui/open-webui/commit/7e253df17593bc12dc5cc89d28703675f05b0158
- github.com/open-webui/open-webui/pull/6054
- huntr.com/bounties/9350a68d-5f33-4b3d-988b-81e778160ab8
- nvd.nist.gov/vuln/detail/CVE-2024-7806
Code Behaviors & Features
Detect and mitigate CVE-2024-7806 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →