CVE-2024-12537: Open WebUI Uncontrolled Resource Consumption Vulnerability
Summary
CVE-2024-12537: Open WebUI Uncontrolled Resource Consumption vulnerability. Affects open-webui versions < 0.3.32. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Open WebUI is a web-based user interface framework that allows developers to build interactive web applications. It provides various utilities and endpoints for formatting code and managing resources. However, in version 0.3.32, it lacks proper authentication mechanisms, making it susceptible to unauthorized access and resource exhaustion attacks.
Vulnerability Detail
The vulnerability arises from the absence of authentication for the api/v1/utils/code/format endpoint in Open WebUI version 0.3.32. This allows any unauthenticated attacker to send a POST request with a large volume of content, potentially overwhelming the server. The consequences include severe performance degradation, causing the server to become unresponsive and leading to service interruptions for legitimate users. The CVSS score for this vulnerability is 7.5, indicating a high severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can implement rate limiting on the server to mitigate the impact of excessive requests. This can be done by configuring your web server or application framework to limit the number of requests from a single IP address within a specified time frame.
Conclusion
The Open WebUI vulnerability CVE-2024-12537 poses a significant risk due to its uncontrolled resource consumption. It is crucial for users to update their packages to the latest version to mitigate this risk and ensure the stability of their applications.
See every vulnerability recorded for open-webui →
FAQ
The vulnerability can lead to server unresponsiveness and performance issues, affecting legitimate users.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring signup.
Implement rate limiting on your server as a temporary measure to reduce the risk of resource exhaustion.
Yes, updating to a version higher than 0.3.32 will resolve the vulnerability.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for open-webui.
