CVE-2024-12534: Open-webui Uncontrolled Resource Consumption Vulnerability
Summary
CVE-2024-12534: Open WebUI Uncontrolled Resource Consumption vulnerability. Affects open-webui versions < 0.3.32. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Open-webui is an open-source web application framework designed to facilitate the development of user interfaces. It provides a set of tools and libraries that enable developers to create responsive and interactive web applications. However, version v0.3.32 of open-webui is susceptible to a significant vulnerability that allows users to submit excessively large payloads during the sign-in process, leading to potential Denial of Service (DoS) conditions.
Vulnerability Detail
In version v0.3.32 of open-webui, the application lacks character length validation on the email and password fields during the sign-in process. This oversight allows users to submit large payloads, which can exhaust server resources such as CPU, memory, and disk space. As a result, legitimate users may be unable to access the service, making the server vulnerable to resource exhaustion attacks without requiring authentication. The CVSS score for this vulnerability is 7.5, indicating a high severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, implement input validation on the email and password fields to restrict the maximum character length. For example, you can add the following validation in your sign-in form:
if len(email) > MAX_LENGTH or len(password) > MAX_LENGTH: raise ValueError('Input exceeds maximum length')
Replace MAX_LENGTH with an appropriate value based on your application's requirements.
Conclusion
The uncontrolled resource consumption vulnerability in open-webui version v0.3.32 poses a significant risk to applications using this framework. By implementing input validation and updating to a patched version, developers can mitigate the risk and ensure the availability of their services.
See every vulnerability recorded for open-webui →
FAQ
The vulnerability can lead to Denial of Service (DoS) conditions, making the application unavailable to legitimate users due to resource exhaustion.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without requiring any signup.
Yes, updating the open-webui package to a version beyond v0.3.32 will resolve this vulnerability.
Implement input validation on the email and password fields to restrict the maximum character length as a temporary workaround.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for open-webui.
